If you discover any security related issues, please email awcodes1@gmail.com instead of using the issue tracker.
Security: awcodes/filament-curator
Security
.github/SECURITY.md
-
SVG sanitization bypass via filename extension, and unvalidated curation pathsGHSA-3xm3-q2fj-x8rq published
Aug 14, 2026 by awcodesModerate -
Stored cross-site scripting via HTML uploads permitted by Curator's default accepted file typesGHSA-fc8p-659h-3959 published
Aug 5, 2026 by awcodesModerate -
Broken access control in CuratorPanel item actions allows editing, deleting, and downloading arbitrary Media recordsGHSA-3m5g-3j68-ghvp published
Jul 25, 2026 by awcodesHigh -
Stored XSS via unsanitized SVG upload served inlineGHSA-8vm9-f75m-5h2m published
Jul 6, 2026 by awcodesModerate -
Cross-tenant media metadata disclosure via Curator picker searchGHSA-828w-6qgx-3rcf published
Jul 6, 2026 by awcodesModerate
Learn more about advisories related to awcodes/filament-curator in the GitHub Advisory Database