p PatchFirst

CVE-2025-27517

CVE-2025-27517 · Volt Allows RCE Via User-Crafted Requests

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0.

CVSS 9.3 · Critical · EPSS 0.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • volt

    Versions
    • < 1.7.0: Affected

    No fix published

  • livewire/volt Packagist

    Versions
    • v1.0.0
    • v1.0.0-beta.1
    • v1.0.0-beta.2
    • v1.0.0-beta.3
    • v1.0.0-beta.4
    • v1.0.0-beta.5
    • v1.0.0-beta.6
    • v1.0.0-beta.7
    • v1.1.0
    • v1.1.1
    • v1.2.0
    • v1.3.0
    • v1.3.1
    • v1.3.2
    • v1.3.3
    • v1.4.0
    • v1.5.0
    • v1.6.0
    • v1.6.1
    • v1.6.2
    • v1.6.3
    • v1.6.4
    • v1.6.5
    • v1.6.6
    • v1.6.7
    Affected ranges
    • ECOSYSTEM: < 1.7.0

    Update to 1.7.0

Original sources

Check your server →