filament/tables

[READ ONLY] Subtree split of the Filament Table Builder (see filamentphp/filament)

View on Packagist

View on Github

Activity

Latest release: 3d ago
Total releases: 833
Cadence: ~daily
Last 12 months: 117

Reach

Stars: 37

Details

License: MIT
First release: Mar 01, 2021

Releases

Version	Released
`v5.7.5` patch	Jul 29, 2026
`v4.12.4` patch	Jul 29, 2026
`v4.12.5` patch	Jul 29, 2026
`v5.7.3` patch	Jul 22, 2026
`v4.12.3` patch	Jul 22, 2026
`v4.12.1` minor	Jul 17, 2026
`v5.7.1` minor	Jul 17, 2026
`v5.7.0-beta4` pre	Jul 14, 2026
`v4.12.0-beta4` pre	Jul 14, 2026
`v5.7.0-beta3` pre	Jul 10, 2026
`v4.12.0-beta3` pre	Jul 10, 2026
`v4.12.0-beta2` pre	Jul 02, 2026
`v5.7.0-beta2` pre	Jul 02, 2026
`v5.6.8` patch	Jul 02, 2026
`v4.11.8` patch	Jul 02, 2026
`v5.7.0-beta1` pre	Jun 25, 2026
`v4.12.0-beta1` pre	Jun 25, 2026
`v3.3.54` patch	Jun 12, 2026
`v5.6.7` patch	Jun 08, 2026
`v4.11.7` patch	Jun 08, 2026
`v5.6.6` patch	May 27, 2026
`v4.11.6` patch	May 27, 2026
`v5.6.5` patch	May 22, 2026
`v4.11.5` patch	May 22, 2026
`v5.6.4` patch 1 CVE	May 20, 2026
`v4.11.4` patch 1 CVE	May 20, 2026
`v3.3.53` patch	May 20, 2026
`v5.6.3` patch 1 CVE	May 11, 2026
`v4.11.3` patch 1 CVE	May 11, 2026
`v5.6.2` patch 1 CVE	May 02, 2026
`v4.11.2` patch 1 CVE	May 02, 2026
`v4.11.1` minor 1 CVE	Apr 21, 2026
`v5.6.1` minor 1 CVE	Apr 21, 2026
`v5.5.2` patch 1 CVE	Apr 14, 2026
`v4.10.2` patch 1 CVE	Apr 14, 2026
`v5.5.0` minor 1 CVE	Apr 03, 2026
`v4.10.0` minor 1 CVE	Apr 03, 2026
`v5.4.3` patch 1 CVE	Mar 29, 2026
`v4.9.3` patch 1 CVE	Mar 29, 2026
`v4.9.1` patch 1 CVE	Mar 19, 2026
`v5.4.1` patch 1 CVE	Mar 19, 2026
`v5.4.0` minor 1 CVE	Mar 17, 2026
`v5.3.5` patch 1 CVE	Mar 14, 2026
`v4.9.0` minor 1 CVE	Mar 14, 2026
`v5.3.4` patch 2 CVEs	Mar 12, 2026
`v4.8.4` patch 2 CVEs	Mar 12, 2026
`v4.8.2` patch 2 CVEs	Mar 06, 2026
`v5.3.2` patch 2 CVEs	Mar 06, 2026
`v5.3.1` minor 2 CVEs	Feb 28, 2026
`v4.8.1` minor 2 CVEs	Feb 28, 2026

1–50 of 833

Repository

filamentphp/tables

Forks: 15
Open issues: 0
Language: PHP

Dependencies (4)

Depends on

v5.7.5

filament/actions self.version
filament/forms self.version
filament/query-builder self.version
filament/support self.version

Used by

Supply-chain exposure

8 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (4)

CVE-2026-48167 GHSA-3fc8-8hp6-6jr4 Jun 23, 2026

Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

6.4 / 10
Medium
Network Low Low None Changed Low Low None

The ImageColumn and ImageEntry components render raw database values without escaping HTML. Where the data passed to these components isn't validated, an attacker could plant malicious HTML or JavaScript and achieve stored XSS that executes for users who view the table or schema.

Affected versions

v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19

+ 91 more Show less

v4.0.2v4.0.20v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.10.0v4.10.1v4.10.2v4.11.0v4.11.1v4.11.2v4.11.3v4.11.4v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.3.0v4.3.1v4.4.0v4.5.0v4.5.1v4.5.2v4.5.3v4.6.0v4.6.1v4.6.2v4.6.3v4.7.0v4.7.1v4.7.2v4.7.3v4.7.4v4.8.0v4.8.1v4.8.2v4.8.3v4.8.4v4.8.5v4.9.0v4.9.1v4.9.2v4.9.3v4.9.4v4.9.5v5.0.0v5.1.0v5.1.1v5.1.2v5.1.3v5.2.0v5.2.1v5.2.2v5.2.3v5.2.4v5.3.0v5.3.1v5.3.2v5.3.3v5.3.4v5.3.5v5.4.0v5.4.1v5.4.2v5.4.3v5.4.4v5.4.5v5.5.0v5.5.1v5.5.2v5.6.0v5.6.1v5.6.2v5.6.3v5.6.4

Fixed in

4.11.55.6.5

References

https://github.com/filamentphp/filament/security/advisories/GHSA-3fc8-8hp6-6jr4
https://nvd.nist.gov/vuln/detail/CVE-2026-48167
https://github.com/filamentphp/filament

Updated Jun 23, 2026 · Source: OSV.dev
CVE-2026-48067 GHSA-7q3w-xqjw-g3cr Jun 11, 2026

Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields

6.5 / 10
Medium
Network Low Low None Unchanged None High None

The recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value.

Affected versions

v3.0.0v3.0.1v3.0.10v3.0.100v3.0.101v3.0.102v3.0.103v3.0.11v3.0.12v3.0.13v3.0.14v3.0.15

+ 338 more Show less

v3.0.16v3.0.17v3.0.18v3.0.19v3.0.2v3.0.20v3.0.21v3.0.22v3.0.23v3.0.24v3.0.25v3.0.26v3.0.27v3.0.28v3.0.29v3.0.3v3.0.30v3.0.31v3.0.32v3.0.33v3.0.34v3.0.35v3.0.36v3.0.37v3.0.38v3.0.39v3.0.4v3.0.40v3.0.41v3.0.42v3.0.43v3.0.44v3.0.45v3.0.46v3.0.47v3.0.48v3.0.49v3.0.5v3.0.50v3.0.51v3.0.52v3.0.53v3.0.54v3.0.55v3.0.56v3.0.57v3.0.58v3.0.59v3.0.6v3.0.60v3.0.61v3.0.62v3.0.63v3.0.64v3.0.65v3.0.66v3.0.67v3.0.68v3.0.69v3.0.7v3.0.70v3.0.71v3.0.72v3.0.73v3.0.74v3.0.75v3.0.76v3.0.77v3.0.78v3.0.79v3.0.8v3.0.80v3.0.81v3.0.82v3.0.83v3.0.84v3.0.85v3.0.86v3.0.87v3.0.88v3.0.89v3.0.9v3.0.90v3.0.91v3.0.92v3.0.93v3.0.94v3.0.95v3.0.96v3.0.97v3.0.98v3.0.99v3.1.0v3.1.0-alpha1v3.1.0-alpha2v3.1.0-alpha3v3.1.0-alpha4v3.1.1v3.1.10v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17v3.1.18v3.1.19v3.1.2v3.1.20v3.1.21v3.1.22v3.1.23v3.1.24v3.1.25v3.1.26v3.1.27v3.1.28v3.1.29v3.1.3v3.1.30v3.1.31v3.1.32v3.1.33v3.1.34v3.1.35v3.1.36v3.1.37v3.1.39v3.1.4v3.1.40v3.1.41v3.1.42v3.1.43v3.1.44v3.1.45v3.1.46v3.1.47v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.1v3.2.10v3.2.100v3.2.101v3.2.102v3.2.103v3.2.104v3.2.105v3.2.106v3.2.107v3.2.108v3.2.109v3.2.11v3.2.110v3.2.111v3.2.112v3.2.113v3.2.114v3.2.115v3.2.116v3.2.117v3.2.118v3.2.119v3.2.12v3.2.120v3.2.121v3.2.122v3.2.123v3.2.124v3.2.125v3.2.126v3.2.127v3.2.128v3.2.129v3.2.13v3.2.130v3.2.131v3.2.132v3.2.133v3.2.134v3.2.135v3.2.136v3.2.137v3.2.138v3.2.139v3.2.14v3.2.140v3.2.141v3.2.142v3.2.15v3.2.16v3.2.17v3.2.18v3.2.19v3.2.2v3.2.20v3.2.21v3.2.22v3.2.23v3.2.24v3.2.25v3.2.25-beta1v3.2.26v3.2.27v3.2.28v3.2.29v3.2.3v3.2.30v3.2.31v3.2.32v3.2.33v3.2.34v3.2.35v3.2.36v3.2.37v3.2.38v3.2.39v3.2.4v3.2.40v3.2.41v3.2.42v3.2.43v3.2.44v3.2.45v3.2.46v3.2.47v3.2.48v3.2.49v3.2.5v3.2.50v3.2.51v3.2.52v3.2.53v3.2.54v3.2.55v3.2.56v3.2.57v3.2.58v3.2.59v3.2.6v3.2.60v3.2.61v3.2.62v3.2.63v3.2.64v3.2.65v3.2.66v3.2.67v3.2.68v3.2.69v3.2.7v3.2.70v3.2.71v3.2.72v3.2.73v3.2.74v3.2.75v3.2.76v3.2.77v3.2.78v3.2.79v3.2.8v3.2.80v3.2.81v3.2.82v3.2.83v3.2.84v3.2.85v3.2.86v3.2.87v3.2.87-beta1v3.2.88v3.2.89v3.2.9v3.2.90v3.2.91v3.2.92v3.2.93v3.2.94v3.2.95v3.2.96v3.2.97v3.2.98v3.2.99v3.3.0v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.16v3.3.17v3.3.18v3.3.19v3.3.2v3.3.20v3.3.21v3.3.22v3.3.23v3.3.24v3.3.25v3.3.26v3.3.27v3.3.28v3.3.29v3.3.3v3.3.30v3.3.31v3.3.32v3.3.33v3.3.34v3.3.35v3.3.36v3.3.37v3.3.38v3.3.39v3.3.4v3.3.40v3.3.41v3.3.42v3.3.43v3.3.45v3.3.46v3.3.47v3.3.48v3.3.49v3.3.5v3.3.50v3.3.6v3.3.7v3.3.8v3.3.9

Fixed in

3.3.51

References

https://github.com/filamentphp/filament/security/advisories/GHSA-7q3w-xqjw-g3cr
https://nvd.nist.gov/vuln/detail/CVE-2026-48067
https://github.com/filamentphp/filament
https://github.com/filamentphp/filament/releases/tag/v3.3.51
https://github.com/filamentphp/filament/releases/tag/v4.11.4
https://github.com/filamentphp/filament/releases/tag/v5.6.4

Updated Jul 18, 2026 · Source: OSV.dev
CVE-2026-33080 GHSA-vv3x-j2x5-36jc Mar 18, 2026

Filament Unvalidated Range and Values summarizer values can be used for XSS

7.3 / 10
High
Network Low Low Required Unchanged High High None

Two Table summarizers (Range, Values) render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers.

Affected versions

v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19

+ 61 more Show less

v4.0.2v4.0.20v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.3.0v4.3.1v4.4.0v4.5.0v4.5.1v4.5.2v4.5.3v4.6.0v4.6.1v4.6.2v4.6.3v4.7.0v4.7.1v4.7.2v4.7.3v4.7.4v4.8.0v4.8.1v4.8.2v4.8.3v4.8.4v5.0.0v5.1.0v5.1.1v5.1.2v5.1.3v5.2.0v5.2.1v5.2.2v5.2.3v5.2.4v5.3.0v5.3.1v5.3.2v5.3.3v5.3.4

Fixed in

4.8.55.3.5

References

https://github.com/filamentphp/filament/security/advisories/GHSA-vv3x-j2x5-36jc
https://nvd.nist.gov/vuln/detail/CVE-2026-33080
https://github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1ed
https://github.com/filamentphp/filament
https://github.com/filamentphp/filament/releases/tag/v4.8.5
https://github.com/filamentphp/filament/releases/tag/v5.3.5

Updated Jun 08, 2026 · Source: OSV.dev
CVE-2024-47186 GHSA-9h9q-qhxg-89xr Sep 27, 2024

Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Summary

If values passed to a ColorColumn or ColumnEntry are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered.

Versions of Filament from v3.0.0 through v3.2.114 are affected.

Please upgrade to Filament v3.2.115.

PoC

For example, using a value such as:

blue;"><script>alert('There\'s a security problem here')</script style="

Would get passed into the @style() Blade directive from Laravel to render the correct background color, where $state contains the value:

<div @style([ "background-color: {$state}" => $state, ])></div>

Since Laravel does not escape special characters within the @style Blade directive, the effective output HTML would be:

<div style="background-color: blue;"><script>alert('There\'s a security problem here')</script style=""></div>

Creating the opportunity for arbitrary JS to run if it was stored in the database.

Response

This vulnerability (in ColorColumn only) was reported by @sv-LayZ, who reported the issue and patched the issue during the evening of 25/09/2024. Thank you Mattis.

The review process concluded on 27/09/2024, which revealed the issue was also present in ColorEntry. This was fixed the same day and Filament v3.2.115 followed to escape any special characters while outputting inline styles like this:

<div @style([ 'background-color: ' . e($state) => $state, ])></div>

Although these components are no longer vulnerable to this type of XSS attack, it is good practice to validate colors, and since many Filament users may be accepting color input using the ColorPicker form component, additional color validation documentation was published.

Affected versions

v3.0.0v3.0.1v3.0.10v3.0.100v3.0.101v3.0.102v3.0.103v3.0.11v3.0.12v3.0.13v3.0.14v3.0.15

+ 260 more Show less

v3.0.16v3.0.17v3.0.18v3.0.19v3.0.2v3.0.20v3.0.21v3.0.22v3.0.23v3.0.24v3.0.25v3.0.26v3.0.27v3.0.28v3.0.29v3.0.3v3.0.30v3.0.31v3.0.32v3.0.33v3.0.34v3.0.35v3.0.36v3.0.37v3.0.38v3.0.39v3.0.4v3.0.40v3.0.41v3.0.42v3.0.43v3.0.44v3.0.45v3.0.46v3.0.47v3.0.48v3.0.49v3.0.5v3.0.50v3.0.51v3.0.52v3.0.53v3.0.54v3.0.55v3.0.56v3.0.57v3.0.58v3.0.59v3.0.6v3.0.60v3.0.61v3.0.62v3.0.63v3.0.64v3.0.65v3.0.66v3.0.67v3.0.68v3.0.69v3.0.7v3.0.70v3.0.71v3.0.72v3.0.73v3.0.74v3.0.75v3.0.76v3.0.77v3.0.78v3.0.79v3.0.8v3.0.80v3.0.81v3.0.82v3.0.83v3.0.84v3.0.85v3.0.86v3.0.87v3.0.88v3.0.89v3.0.9v3.0.90v3.0.91v3.0.92v3.0.93v3.0.94v3.0.95v3.0.96v3.0.97v3.0.98v3.0.99v3.1.0v3.1.0-alpha1v3.1.0-alpha2v3.1.0-alpha3v3.1.0-alpha4v3.1.1v3.1.10v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17v3.1.18v3.1.19v3.1.2v3.1.20v3.1.21v3.1.22v3.1.23v3.1.24v3.1.25v3.1.26v3.1.27v3.1.28v3.1.29v3.1.3v3.1.30v3.1.31v3.1.32v3.1.33v3.1.34v3.1.35v3.1.36v3.1.37v3.1.39v3.1.4v3.1.40v3.1.41v3.1.42v3.1.43v3.1.44v3.1.45v3.1.46v3.1.47v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.1v3.2.10v3.2.100v3.2.101v3.2.102v3.2.103v3.2.104v3.2.105v3.2.106v3.2.107v3.2.108v3.2.109v3.2.11v3.2.110v3.2.111v3.2.112v3.2.113v3.2.114v3.2.12v3.2.13v3.2.14v3.2.15v3.2.16v3.2.17v3.2.18v3.2.19v3.2.2v3.2.20v3.2.21v3.2.22v3.2.23v3.2.24v3.2.25v3.2.25-beta1v3.2.26v3.2.27v3.2.28v3.2.29v3.2.3v3.2.30v3.2.31v3.2.32v3.2.33v3.2.34v3.2.35v3.2.36v3.2.37v3.2.38v3.2.39v3.2.4v3.2.40v3.2.41v3.2.42v3.2.43v3.2.44v3.2.45v3.2.46v3.2.47v3.2.48v3.2.49v3.2.5v3.2.50v3.2.51v3.2.52v3.2.53v3.2.54v3.2.55v3.2.56v3.2.57v3.2.58v3.2.59v3.2.6v3.2.60v3.2.61v3.2.62v3.2.63v3.2.64v3.2.65v3.2.66v3.2.67v3.2.68v3.2.69v3.2.7v3.2.70v3.2.71v3.2.72v3.2.73v3.2.74v3.2.75v3.2.76v3.2.77v3.2.78v3.2.79v3.2.8v3.2.80v3.2.81v3.2.82v3.2.83v3.2.84v3.2.85v3.2.86v3.2.87v3.2.87-beta1v3.2.88v3.2.89v3.2.9v3.2.90v3.2.91v3.2.92v3.2.93v3.2.94v3.2.95v3.2.96v3.2.97v3.2.98v3.2.99

Fixed in

3.2.115

References

https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr
https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316
https://github.com/filamentphp/filament
https://github.com/filamentphp/filament/releases/tag/v3.2.115

Updated Feb 17, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 4
minor 46
patch 620
pre 162

833 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More