CVE-2026-55409: Filament RichEditor Stored XSS in Disabled Fields (3.0.0–3.3.52)

Technical summary

The vulnerability exists in Filament's RichEditor component when rendered in a disabled state. The component fails to sanitize HTML entities and JavaScript in its output, allowing stored XSS attacks. The attack vector requires prior authentication (PR:L) and user interaction to trigger (UI:R), but the impact is cross-site scripting that can steal credentials, hijack sessions, or deface forms viewed by other users. The root cause is the absence of HTML escaping or output encoding when the disabled state is rendered; the component assumes incoming data is already safe, which may not be true if state is populated from unsanitized sources (databases, APIs, or user input processed elsewhere).

Business impact

Organizations using affected Filament versions face XSS risk in any forms or dashboards that display disabled RichEditor fields. The practical impact depends on deployment context: internal admin panels have lower blast radius but affect trusted staff; customer-facing forms pose higher risk if user-controlled data flows into RichEditor state. Compromised user sessions could lead to unauthorized actions, data exfiltration, or lateral movement within applications. Incident response will require identifying all forms using RichEditor, auditing for stored malicious payloads, and notifying affected users if exploitation occurred.

Affected systems

All applications using Filament versions 3.0.0 through 3.3.52 that include RichEditor components in disabled state are potentially vulnerable. Exposure is highest in admin panels, customer dashboards, and any form where: (1) RichEditor is disabled but still rendered, (2) state is populated from user-controlled or insufficiently sanitized data sources, and (3) multiple users view the same form instance. Version 3.3.53 and later are unaffected. Earlier stable versions prior to 3.0.0 should be assessed separately against Filament's changelog.

Exploitability

Exploitation requires authenticated access (users must have login capability) and relies on social engineering or UI interaction to trigger viewing of the malicious form. An attacker cannot exploit this remotely without first gaining application access or compromising an account. However, once a payload is stored in a RichEditor field, it executes automatically for any subsequent user viewing that form—making it a persistent, high-confidence attack vector compared to reflected XSS. The barrier to weaponization is low if the attacker already has form submission access or can manipulate data at rest.

Remediation

Upgrade Filament to version 3.3.53 or later as soon as feasible. In parallel, apply defense-in-depth measures: (1) audit all RichEditor field data for HTML/JavaScript patterns, (2) sanitize any unsanitized state sources using a library like HTMLPurifier or similar, and (3) implement Content Security Policy headers to restrict inline script execution. For short-term risk reduction on unpatched systems, disable RichEditor components where possible or restrict access to forms containing them.

Patch guidance

Filament's patch for this vulnerability is included in version 3.3.53. Review the vendor's release notes at releases.filamentphp.com to confirm the fix and any breaking changes. Plan a staged rollout: test 3.3.53 in a development environment against your application's form workflows, verify that disabled RichEditor fields no longer render unescaped HTML, and confirm backward compatibility with any custom RichEditor extensions. If you use Composer, update via `composer update filament/filament:^3.3.53`.

Detection guidance

Search application logs and database records for disabled RichEditor field instances containing HTML tags such as <script>, <img onerror>, <svg onload>, or other event handlers. Use regex patterns to identify suspicious payloads (e.g., /\<script[^>]*\>|on\w+\=|javascript:/i). Monitor browser console errors and CSP violation reports for unexpected inline script execution. If CSP is not yet implemented, enable it in report-only mode to baseline current violations, then tighten rules to block inline scripts. Test forms with stored test payloads in a staging environment to verify sanitization is working post-patch.

Why prioritize this

This vulnerability merits prompt remediation despite not being on the CISA KEV list. The combination of authenticated access (moderate barrier), persistent execution (high impact once triggered), and ease of weaponization (straightforward HTML injection) creates meaningful risk. The CVSS 7.6 HIGH score reflects the cross-site impact (S:C) and high confidentiality impact (C:H), justified by session theft and data exfiltration scenarios. Organizations should prioritize based on form exposure: customer-facing or admin panels with many users should upgrade within 1–2 weeks; internal tools with few users can follow a standard patch cycle.

Risk score, explained

The CVSS 7.6 (HIGH) score reflects: Network-based attack vector (any authenticated user can trigger), Low attack complexity (no special conditions needed), Low privilege requirement (authenticated users suffice), Required user interaction (victim must view the form), and Scope changed (XSS can affect other users and the application beyond its security scope). Confidentiality is rated High because stolen session tokens or data are possible; Integrity is Low because the attacker modifies display only, not persistent app state; Availability is None. The score appropriately weights the persistent, cross-user impact of stored XSS in a commonly-accessed component.

Frequently asked questions