{"items":[{"id":"NVI-00002995","kind":"vulnerability","title":"Filament has exported files stored in default (`public`) filesystem if not reconfigured","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-4hxw-gc2q-f6f3","CVE-2024-51758"],"plain_summary":"OSV carries this publisher advisory for filament/actions. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.2.123 for filament/actions. Confirm the publisher’s latest guidance.","source_ids":["sr-2e83c08e39242e3bfb57e719a3fa3bd5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-718c728ae74228af8ca979eb620728aa"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T08:06:16.690Z","value":"2.3 LOW (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-3a237f5295eac923eb2b64dfb3471d13"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.564%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.46897. Missing scores are unknown.","source_id":"sr-718c728ae74228af8ca979eb620728aa"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2e83c08e39242e3bfb57e719a3fa3bd5","url":"https://github.com/advisories/GHSA-4hxw-gc2q-f6f3","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-4hxw-gc2q-f6f3","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.669Z"},{"id":"sr-3a237f5295eac923eb2b64dfb3471d13","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51758","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2024-51758","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T00:59:43.945Z"},{"id":"sr-718c728ae74228af8ca979eb620728aa","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2024-51758","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.369Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2e83c08e39242e3bfb57e719a3fa3bd5"],"technology":"filament/actions","known_exclusions":[],"conditions_summary":"All Filament features that interact with storage use the `default_filesystem_disk` config option. This allows the user to easily swap their storage driver to something production-ready like `s3` when deploying their app, without having to touch multiple configuration options and potentially forgetting about some.\n\nThe default disk is set to `public` when you first install Filament, since this allows users to quickly get started developing with a functional disk that allows features such as file upload previews locally without the need to set up an S3 disk with temporary URL support.\n\nHowever, some features of Filament such as exports also rely on storage, and the files that are stored contain data that should often not be public. This is not an issue for the many deployed applications, since many use a secure default disk such as S3 in production. However, CWE-1188 suggests that having the `public` disk as the default disk in Filament is a security vulnerability itself:\n\n> Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator ca","public_affected_ranges":["ECOSYSTEM: introduced 3.2.0; fixed 3.2.123"]}],"null_published_at":"2026-11-01T19:14:01.591Z","source_updated_at":"2026-09-10T03:50:20.441Z","source_disclosed_at":"2024-11-07T16:14:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.669Z"},{"id":"NVI-00002995","kind":"vulnerability","title":"Filament has exported files stored in default (`public`) filesystem if not reconfigured","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-4hxw-gc2q-f6f3","CVE-2024-51758"],"plain_summary":"OSV carries this publisher advisory for filament/actions. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.2.123 for filament/actions. Confirm the publisher’s latest guidance.","source_ids":["sr-2e83c08e39242e3bfb57e719a3fa3bd5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3a237f5295eac923eb2b64dfb3471d13"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T08:06:16.690Z","value":"2.3 LOW (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-3a237f5295eac923eb2b64dfb3471d13"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2e83c08e39242e3bfb57e719a3fa3bd5","url":"https://github.com/advisories/GHSA-4hxw-gc2q-f6f3","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-4hxw-gc2q-f6f3","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.669Z"},{"id":"sr-3a237f5295eac923eb2b64dfb3471d13","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51758","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2024-51758","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T00:59:43.945Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2e83c08e39242e3bfb57e719a3fa3bd5"],"technology":"filament/actions","known_exclusions":[],"conditions_summary":"All Filament features that interact with storage use the `default_filesystem_disk` config option. This allows the user to easily swap their storage driver to something production-ready like `s3` when deploying their app, without having to touch multiple configuration options and potentially forgetting about some.\n\nThe default disk is set to `public` when you first install Filament, since this allows users to quickly get started developing with a functional disk that allows features such as file upload previews locally without the need to set up an S3 disk with temporary URL support.\n\nHowever, some features of Filament such as exports also rely on storage, and the files that are stored contain data that should often not be public. This is not an issue for the many deployed applications, since many use a secure default disk such as S3 in production. However, CWE-1188 suggests that having the `public` disk as the default disk in Filament is a security vulnerability itself:\n\n> Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator ca","public_affected_ranges":["ECOSYSTEM: introduced 3.2.0; fixed 3.2.123"]}],"null_published_at":"2026-11-01T01:04:01.286Z","source_updated_at":"2026-09-10T03:50:20.441Z","source_disclosed_at":"2024-11-07T16:14:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:49.669Z"},{"id":"NVI-00002995","kind":"vulnerability","title":"Filament has exported files stored in default (`public`) filesystem if not reconfigured","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4hxw-gc2q-f6f3","CVE-2024-51758"],"plain_summary":"OSV carries this publisher advisory for filament/actions. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.2.123 for filament/actions. Confirm the publisher’s latest guidance.","source_ids":["sr-2e83c08e39242e3bfb57e719a3fa3bd5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2e83c08e39242e3bfb57e719a3fa3bd5","url":"https://github.com/advisories/GHSA-4hxw-gc2q-f6f3","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-4hxw-gc2q-f6f3","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.669Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2e83c08e39242e3bfb57e719a3fa3bd5"],"technology":"filament/actions","known_exclusions":[],"conditions_summary":"All Filament features that interact with storage use the `default_filesystem_disk` config option. This allows the user to easily swap their storage driver to something production-ready like `s3` when deploying their app, without having to touch multiple configuration options and potentially forgetting about some.\n\nThe default disk is set to `public` when you first install Filament, since this allows users to quickly get started developing with a functional disk that allows features such as file upload previews locally without the need to set up an S3 disk with temporary URL support.\n\nHowever, some features of Filament such as exports also rely on storage, and the files that are stored contain data that should often not be public. This is not an issue for the many deployed applications, since many use a secure default disk such as S3 in production. However, CWE-1188 suggests that having the `public` disk as the default disk in Filament is a security vulnerability itself:\n\n> Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator ca","public_affected_ranges":["ECOSYSTEM: introduced 3.2.0; fixed 3.2.123"]}],"null_published_at":"2026-10-31T22:12:38.467Z","source_updated_at":"2026-09-10T03:50:20.441Z","source_disclosed_at":"2024-11-07T16:14:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:49.669Z"}],"next_cursor":null,"snapshot_revision":"42594"}