CVE-2026-48167

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.11.5 Filament versions prior to 5.6.5

Description The ImageColumn and ImageEntry components render raw database values without escaping HTML. If the data passed to these components is not validated, an attacker can inject malicious HTML or JavaScript, leading to stored Cross-Site Scripting (XSS), which is a security flaw where a script is permanently stored on the target server and executed in the browser of users viewing the affected table or schema.

Recommendations Update to version 4.11.5. Update to version 5.6.5.