References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs. This vulnerability is fixed in 3.3.52, 4.11.5, and 5.6.5.

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE-862

https://github.com/filamentphp/filament/security/advisories/GHSA-44wp-g8f4-f4v5

[{"vendor":"filamentphp","product":"filament","versions":[{"version":">= 3.0.0, < 3.3.52","status":"affected"},{"version":">= 5.0.0, < 5.6.5","status":"affected"},{"version":">= 4.0.0, < 4.11.5","status":"affected"}]}]