CVE-2026-48500: Filament Unauthenticated File Upload Vulnerability

Technical summary

Filament applies Livewire's WithFileUploads trait globally to components that embed file upload fields in their schemas. This design choice exposes temporary file upload functionality on unauthenticated endpoints, including the panel login form. An attacker can POST to the upload endpoint and write arbitrary files to the application's temporary storage directory without authentication. The vulnerability stems from a failure to distinguish between components that legitimately need file uploads (like user profile forms) and those that don't (like login pages). The temporary files persist until cleanup routines execute, creating a window for resource exhaustion attacks.

Business impact

Attackers can abuse this vulnerability to conduct denial-of-service attacks by rapidly filling temporary storage with large files, potentially causing application failures or service interruptions. Organizations using cloud storage or pay-per-GB infrastructure may face unexpected cost inflation. The vulnerability is particularly concerning for multi-tenant Filament installations where one attacker's upload abuse could degrade service for all users. While the vulnerability doesn't grant unauthorized access to data or system compromise, the availability impact can disrupt business operations.

Affected systems

This vulnerability affects Filament versions: 3.0.0 through 3.3.51, 4.0.0 through 4.11.4, and 5.0.0 through 5.6.4. Any Laravel application using Filament with schema-based forms is potentially affected. Organizations should audit their Filament installations to identify the currently deployed version. The vulnerability is most critical for publicly accessible Filament panels (such as customer-facing applications) where unauthenticated attackers have direct access to the login form.

Exploitability

This vulnerability is straightforward to exploit—an attacker needs only network access to a Filament application and knowledge of the standard Livewire file upload endpoint. No special tools, authentication, or user interaction is required. The attack can be automated with simple scripting to continuously upload files. The lack of authentication or rate-limiting on the upload endpoint makes this a low-barrier attack. However, practical impact depends on storage quotas, cleanup frequency, and monitoring in place; organizations with aggressive temporary file purging or strict disk quotas may experience reduced impact.

Remediation

Upgrade to patched versions: 3.3.52 or later for the 3.x branch, 4.11.5 or later for the 4.x branch, or 5.6.5 or later for the 5.x branch. These versions implement conditional file upload trait application, restricting the WithFileUploads trait to only components that actually define file upload fields. Apply the patch as soon as possible to all Filament installations, prioritizing public-facing or multi-tenant deployments.

Patch guidance

Review your Filament deployment and identify the current version using composer show or package.json inspection. Plan an upgrade following your standard release management process. For most applications, the patch versions represent bug fixes with minimal breaking changes, but verify against the official Filament changelog before deploying. Test the upgrade in a staging environment to confirm that file upload functionality still works correctly on forms that intentionally use it. Consider deploying during a low-impact maintenance window to minimize user disruption.

Detection guidance

Monitor application logs for suspicious POST requests to Livewire temporary file upload endpoints (typically /livewire/upload or similar paths). Track temporary directory disk usage for anomalous growth, especially outside normal business operations. Implement rate-limiting or CAPTCHA challenges on the login form and other unauthenticated endpoints to slow brute-force upload attacks. Set up alerts for temporary directory size thresholds. Review access logs for repeated upload requests originating from external IP addresses.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the ease of exploitation and potential for service disruption justify prompt patching. The vulnerability requires no authentication, making it accessible to any attacker on the network. Organizations with strict storage constraints, multi-tenant architectures, or cloud infrastructure should treat this as high-priority due to cost and availability implications.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with low complexity and no authentication requirement, resulting in medium severity. The score appropriately accounts for the lack of confidentiality impact but captures integrity and availability concerns. In practice, the real-world risk depends heavily on your infrastructure's storage capacity, cost model, and monitoring posture. Organizations running cost-sensitive cloud deployments may consider this higher-risk than the base score suggests.

Frequently asked questions