Is filament/filament 4.11 vulnerable?
Composer · 9 releases from 4.11.0 to 4.11.8 · latest filament/filament is 5.11.0 · checked 2 Nov 2026
Yes: 4 known advisories
Yes. filament/filament 4.11.8, the last 4.11 release, is affected by 4 known security advisories (1 high, 2 medium, 1 low), including CVE-2026-77567, CVE-2026-104181, CVE-2026-84306. 3 more affect earlier 4.11.x releases. Upgrade to 4.13.3 or later to fix all of them.
composer require filament/filament:^4.13.3Advisories affecting filament/filament 4.11.8
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
- Affected
- >=4.0.0 <4.13.3 · >=5.0.0 <5.8.3
- Fixed in
- 4.13.3, 5.8.3
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
- Affected
- >=4.0.0 <4.12.6 · >=5.0.0 <5.7.6
- Fixed in
- 4.12.6, 5.7.6
Filament: Password validity disclosure for accounts denied panel access on login page
- Affected
- >=4.0.0 <4.12.5 · >=5.0.0 <5.7.5
- Fixed in
- 4.12.5, 5.7.5
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
- Affected
- >=4.0.0 <4.12.0 · >=5.0.0 <5.7.0
- Fixed in
- 4.12.0, 5.7.0
Fixed within 4.11.x, affecting earlier releases
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
- Affected
- >=4.0.0 <4.11.5 · >=5.0.0 <5.6.5
- Fixed in
- 4.11.5, 5.6.5
Filament: Unauthenticated temporary file upload on auth pages
- Affected
- >=4.0.0 <4.11.5 · >=5.0.0 <5.6.5 · >=3.0.0 <3.3.52
- Fixed in
- 3.3.52, 4.11.5, 5.6.5
Filament: Timing-based user enumeration on login page
- Affected
- >=4.0.0 <4.11.5 · >=5.0.0 <5.6.5
- Fixed in
- 4.11.5, 5.6.5
Which of your client projects are still on filament/filament 4.11?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact filament/filament version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other filament/filament versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.