Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

filamentphp/filament

              4.x @ ef8bb3a
            

Fixes

CVEs

HIGH

Peak severity

27.0%

Coverage

Highlights

Auth Bypass: 38 prior fixes. Scrutinize any change in this area.

packages/forms/src/Components/BaseFileUpload.php: most-fixed (9 issues). Treat as high-risk during review.

44 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Authorization checks performed only during the initial mount phase were bypassed during subsequent Livewire state hydration requests, requiring a fix to re-evaluate permissions on every request cycle.

Cross-Site Scripting (XSS): Unescaped Blade and PHP tags rendered database values directly into HTML summarizers, allowing malicious script execution. This pattern corresponds directly to CVE-2026-33080.

MFA Bypass: Improper state tracking allowed the infinite reuse and replay of MFA recovery codes (CVE-2025-67507). This was corrected by integrating cache-based replay tracking and explicit database/one-way hashing transaction locks.