Is filament/filament 4.9 vulnerable?
Composer · 6 releases from 4.9.0 to 4.9.5 · latest filament/filament is 5.11.0 · checked 2 Nov 2026
Yes: 7 known advisories
Yes. filament/filament 4.9.5, the last 4.9 release, is affected by 7 known security advisories (2 high, 4 medium, 1 low), including CVE-2026-77567, CVE-2026-48505, CVE-2026-104181. Upgrade to 4.13.3 or later to fix all of them.
composer require filament/filament:^4.13.3Advisories affecting filament/filament 4.9.5
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
- Affected
- >=4.0.0 <4.13.3 · >=5.0.0 <5.8.3
- Fixed in
- 4.13.3, 5.8.3
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
- Affected
- >=4.0.0 <4.12.6 · >=5.0.0 <5.7.6
- Fixed in
- 4.12.6, 5.7.6
Filament: Password validity disclosure for accounts denied panel access on login page
- Affected
- >=4.0.0 <4.12.5 · >=5.0.0 <5.7.5
- Fixed in
- 4.12.5, 5.7.5
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
- Affected
- >=4.0.0 <4.12.0 · >=5.0.0 <5.7.0
- Fixed in
- 4.12.0, 5.7.0
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
- Affected
- >=4.0.0 <4.11.5 · >=5.0.0 <5.6.5
- Fixed in
- 4.11.5, 5.6.5
Filament: Unauthenticated temporary file upload on auth pages
- Affected
- >=4.0.0 <4.11.5 · >=5.0.0 <5.6.5 · >=3.0.0 <3.3.52
- Fixed in
- 3.3.52, 4.11.5, 5.6.5
Filament: Timing-based user enumeration on login page
- Affected
- >=4.0.0 <4.11.5 · >=5.0.0 <5.6.5
- Fixed in
- 4.11.5, 5.6.5
Which of your client projects are still on filament/filament 4.9?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact filament/filament version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other filament/filament versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.