awcodes/filament-curator

A media picker and manager for Filament, with Glide-backed image transformations and per-image curations.

Latest v5.5.4

86%

Total Score

healthy

Frequent releases and active commits show a maintained package; one workflow audit warning prevents a clean bill of health.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

The package uses a post-autoload-dump install lifecycle script. This is a point to review in Composer environments, but the signal does not show destructive or unusually broad behavior.

Workflow audit

Both workflows were analyzed successfully, all four action references are pinned, and no untrusted checkout or script injection was found. However, the high-confidence bot-conditions finding in the Dependabot auto-merge workflow and a top-level write permission add CI hygiene risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-661685 awcodes/filament-curator is vulnerable to Path Traversal in versions 3.0.0 - 3.7.10, 4.0.0 - 4.2.0 and 5.0.0 - 5.3.1.	3.0.0 - 3.7.104.0.0 - 4.2.05.0.0 - 5.3.1	Medium
AIKIDO-2026-972512 awcodes/filament-curator is vulnerable to Cross-Site Scripting (XSS) in versions 4.0.0 - 4.1.4 and 5.0.0 - 5.1.4.	4.0.0 - 4.1.45.0.0 - 5.1.4	Medium
AIKIDO-2026-878390 awcodes/filament-curator is vulnerable to Broken Access Control in versions 0.0.1 - 3.7.9, 4.0.0 - 4.1.2 and 5.0.0 - 5.1.2.	0.0.1 - 3.7.94.0.0 - 4.1.25.0.0 - 5.1.2	High

Package versions

Maintainers

awcodes

Direct Dependencies

Dependency	Last Release	Score
league/glide Version ^3.0	—	—
filament/filament Version ^4.0\|^5.0	—	—
enshrined/svg-sanitize Version ^0.22\|^1.0	—	—
spatie/laravel-package-tools Version ^1.15.0	—	—