CVE-2024-51758: Filament has exported files stored in default (`public`) filesystem if not reconfigured

low Affects filament/actions. Feed 2026.10.29.4, updated 2026-10-29; published 2024-11-07; advisory modified 2026-09-10.

Filament has exported files stored in default (`public`) filesystem if not reconfigured

Package: filament/actions Composer
Affected versions: >=3.2.0 and <3.2.123
Fixed in: 3.2.123
Severity: low CVSS 2.4
Exploitation: not on CISA KEV · EPSS 1% (46.8th percentile)
Published: 2024-11-07
Source: osv.dev

References

CWE-1188

NVD record filament/actions advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2026-48067 medium Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Selec same package: filament/actions
CVE-2017-5491 medium wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended post same weakness: CWE-1188
CVE-2026-52824 critical Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover same weakness: CWE-1188
CVE-2026-35672 high phpMyFAQ: Default Empty API Token Authentication Bypass same weakness: CWE-1188
CVE-2025-32378 medium Shopware default newsletter opt-in settings allow for mass sign-up abuse same weakness: CWE-1188
CVE-2024-34102 KEV critical Magento Open Source affected by an Improper Restriction of XML External Entity Reference ( also from 2024