Filament: Unauthenticated temporary file upload on auth pages
Published 23 Jun 2026 · Updated 10 Sept 2026
Affected packages
- Affected
- >=4.0.0 <4.11.5
- Fixed in
- 4.11.5
composer require filament/filament:^4.11.5- Affected
- >=5.0.0 <5.6.5
- Fixed in
- 5.6.5
composer require filament/filament:^5.6.5- Affected
- >=3.0.0 <3.3.52
- Fixed in
- 3.3.52
composer require filament/filament:^3.3.52Details
Any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs.
Is GHSA-44wp-g8f4-f4v5 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected filament/filament, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.