CVE-2026-55409 - Filament: Disabled RichEditor field state can be used for XSS

Back Back to CVE browser

HIGH

Filament: Disabled RichEditor field state can be used for XSS

Published Jun 22, 2026

7.6

HIGH

CVSS 3.1

EPSS 0.28%

Description

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53.

Affected products

Vendor Filamentphp Product Filament Default
n/a
- Version
  >= 3.0.0, < 3.3.53
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Filamentphp

Filament

n/a

Version	Status	Constraints
>= 3.0.0, < 3.3.53	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38397		Advisory
https://github.com/advisories/GHSA-m9cv-24rx-8mv7		Advisory
https://github.com/filamentphp/filament/pull/20029
https://github.com/filamentphp/filament/releases/tag/v3.3.53
https://github.com/filamentphp/filament/security/advisories/GHSA-m9cv-24rx-8mv7		x_refsource_CONFIRM