CVE-2026-48067
EUVD-2026-3839622.06.2026, 22:16
Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value. This vulnerability is fixed in filament/actions 4.11.4 and 5.6.4 and filament/tables 3.3.51.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| filamentphp | filament | 4.0.0 ≤ 𝑥 < 4.11.4 | CNA |
| filamentphp | filament | 5.0.0 ≤ 𝑥 < 5.6.4 | CNA |
| filamentphp | filament | 3.0.0 ≤ 𝑥 < 3.3.51 | CNA |
Common Weakness Enumeration