CVE-2026-48500: Unauthenticated file upload in Filament

CVE-2026-48500 affects Filament, a full-stack component library for Laravel. The vulnerability exposes file upload forms on unauthenticated schemas by applying the Livewire WithFileUploads trait to critical components such as login forms. An unauthenticated attacker can upload arbitrary files to the application's temporary storage without access controls, risking service availability.

CVSS 6.5 (Medium) reflects the unauthenticated nature and denial-of-service impact via disk exhaustion or cloud storage cost inflation. The vulnerability was patched on June 22, 2026 in versions 3.3.52, 4.11.5, and 5.6.5. A GitHub signal today indicates that technical material related to exploitation is available or receiving public attention: for administrators, this means urgent need for verification and update.

Administrators must immediately identify vulnerable Filament instances and apply updates to patched versions 3.3.52, 4.11.5, or 5.6.5. Audit temporary upload logs for suspicious retroactive activity. Implement monitoring on disk quota and storage costs; restrict space allocated for temporary uploads; evaluate whether the WithFileUploads trait is truly necessary on login forms and other sensitive components that do not require file uploads.