p PatchFirst

CVE-2025-14894

CVE-2025-14894

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.

CVSS 7.5 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • livewire filemanager

    Versions
    • ≥ 0, < 1.0: Affected (custom)

    Update to 1.0

  • livewire-filemanager/filemanager Packagist

    Versions
    • v0.1.0
    • v0.1.1
    • v0.1.10
    • v0.1.11
    • v0.1.13
    • v0.1.14
    • v0.1.15
    • v0.1.16
    • v0.1.17
    • v0.1.18
    • v0.1.19
    • v0.1.2
    • v0.1.20
    • v0.1.21
    • v0.1.22
    • v0.1.23
    • v0.1.24
    • v0.1.25
    • v0.1.26
    • v0.1.27
    • v0.1.28
    • v0.1.29
    • v0.1.3
    • v0.1.30
    • v0.1.31
    • v0.1.32
    • v0.1.33
    • v0.1.34
    • v0.1.35
    • v0.1.36
    • v0.1.37
    • v0.1.38
    • v0.1.39
    • v0.1.4
    • v0.1.40
    • v0.1.41
    • v0.1.42
    • v0.1.43
    • v0.1.44
    • v0.1.45
    • v0.1.46
    • v0.1.47
    • v0.1.48
    • v0.1.49
    • v0.1.5
    • v0.1.50
    • v0.1.51
    • v0.1.52
    • v0.1.6
    • v0.1.7
    • v0.1.8
    • v0.1.9
    • v1.0.0
    • v1.0.1
    • v1.0.2
    • v1.0.3
    • v1.0.4
    Affected ranges
    • ECOSYSTEM: ≤ 1.0.4

    No fix published

Original sources

Check your server →