Is filament/filament 4.12 vulnerable?
Composer · 9 releases from 4.12.0 to 4.12.8 · latest filament/filament is 5.11.0 · checked 2 Nov 2026
Yes: 1 known advisory
Yes. filament/filament 4.12.8, the last 4.12 release, is affected by 1 known security advisory (1 medium), including CVE-2026-104181. 2 more affect earlier 4.12.x releases. Upgrade to 4.13.3 or later to fix all of them.
composer require filament/filament:^4.13.3Advisories affecting filament/filament 4.12.8
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
- Affected
- >=4.0.0 <4.13.3 · >=5.0.0 <5.8.3
- Fixed in
- 4.13.3, 5.8.3
Fixed within 4.12.x, affecting earlier releases
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
- Affected
- >=4.0.0 <4.12.6 · >=5.0.0 <5.7.6
- Fixed in
- 4.12.6, 5.7.6
Filament: Password validity disclosure for accounts denied panel access on login page
- Affected
- >=4.0.0 <4.12.5 · >=5.0.0 <5.7.5
- Fixed in
- 4.12.5, 5.7.5
Which of your client projects are still on filament/filament 4.12?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact filament/filament version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other filament/filament versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.