CVE-2026-48067
Description
Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value. This vulnerability is fixed in filament/actions 4.11.4 and 5.6.4 and filament/tables 3.3.51.
How to fix
- filament/tables3.3.51 or later
- filament/actions4.11.4, 5.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| filament/tablesPackagist | 3.0.0 ≤ v < 3.3.51 | 3.3.51 |
| filament/actionsPackagist | 4.0.0 ≤ v < 4.11.4, 5.0.0 ≤ v < 5.6.4 | 4.11.4, 5.6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.