CVE-2026-48500 Overview
CVE-2026-48500 affects Filament, a collection of full-stack components for accelerated Laravel development. The vulnerability exists in versions 3.0.0 through 3.3.51, 4.0.0 through 4.11.4, and 5.0.0 through 5.6.4. Filament applies Livewire's WithFileUploads trait to any Livewire component containing a schema with a file upload field. This trait is also applied to schemas that do not require uploads, such as the panel login form. An unauthenticated attacker can upload arbitrary files to the application's temporary storage on these components. The flaw is classified as Missing Authorization [CWE-862].
Critical Impact
Unauthenticated attackers can upload arbitrary files to temporary storage, exhausting disk space and inflating cloud storage costs.
Affected Products
- Filament 3.0.0 through 3.3.51
- Filament 4.0.0 through 4.11.4
- Filament 5.0.0 through 5.6.4
Discovery Timeline
- 2026-06-22 - CVE-2026-48500 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-48500
Vulnerability Analysis
Filament is a Laravel application framework built atop Livewire. The framework allows developers to define schemas containing form fields, including file upload fields. To support uploads, Filament unconditionally attaches Livewire's WithFileUploads trait to every Livewire component hosting a schema. This applies even when the embedded schema contains no file upload field.
Components such as the panel login form are reachable without authentication. Attaching WithFileUploads to these components exposes Livewire's temporary file upload endpoint to unauthenticated requests. Attackers can submit repeated upload requests to consume disk space or inflate object storage costs on platforms with usage-based billing.
Root Cause
The root cause is missing authorization on the file upload endpoint exposed via the WithFileUploads trait [CWE-862]. Filament applies the trait globally rather than conditionally enabling it only for schemas that declare an upload field. Components without upload requirements still accept temporary file uploads from any unauthenticated caller.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted Livewire upload requests directly to public components, such as the panel login route. Repeated requests fill the temporary storage location with attacker-controlled files. Because the uploads target temporary storage, the impact centers on resource consumption and storage cost amplification rather than persistent file placement or code execution.
No verified proof-of-concept code is published. See the GitHub Security Advisory for additional technical detail.
Detection Methods for CVE-2026-48500
Indicators of Compromise
- Unusual growth of the Livewire temporary upload directory, typically under storage/app/livewire-tmp/ or the configured Livewire temporary disk.
- High volumes of POST requests to Livewire upload endpoints originating from unauthenticated sessions.
- Cloud storage billing spikes tied to the Filament application's temporary upload bucket.
Detection Strategies
- Inspect web server logs for repeated requests to Livewire upload routes (/livewire/upload-file) originating from clients that have not authenticated to the panel.
- Correlate request rates against the same source IP or user agent to identify automated upload flooding.
- Track filesystem growth on the temporary upload location and alert on sudden expansion.
Monitoring Recommendations
- Enable application-level logging for Livewire file upload events with source IP attribution.
- Configure storage quota alerts on the disk or bucket backing Livewire's temporary upload location.
- Monitor egress costs and request counts on cloud storage providers hosting the temporary upload disk.
How to Mitigate CVE-2026-48500
Immediate Actions Required
- Upgrade Filament to version 3.3.52, 4.11.5, or 5.6.5 according to the major version in use.
- Audit existing temporary upload directories and remove unauthorized files staged by anonymous callers.
- Restrict network access to unauthenticated panel routes where feasible while patches are applied.
Patch Information
The maintainers fixed the vulnerability in Filament 3.3.52, 4.11.5, and 5.6.5. The patched versions stop applying the WithFileUploads trait to Livewire components whose schemas do not require file uploads. Refer to the Filament GitHub Security Advisory GHSA-44wp-g8f4-f4v5 for release details.
Workarounds
- Place a rate-limiting layer in front of Livewire upload endpoints to throttle anonymous requests.
- Configure short retention on the Livewire temporary disk so abandoned uploads are purged quickly.
- Restrict access to the panel login route by IP allowlist where deployment topology permits.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
