CVE-2025-14894 Details
Description
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
A remote code execution vulnerability has been identified in Livewire Filemanager, a package commonly used in Laravel applications. The issue arises in the LivewireFilemanagerComponent.php file, where the component fails to validate file types and MIME types during uploads. This oversight allows users to upload malicious PHP files, which can then be executed via the /storage/ URL, provided that the application has undergone a typical setup process that includes linking the storage directory.
As of now, the vendor has not acknowledged this vulnerability. However, it is recommended to exercise caution when using Laravel Filemanager. Check if the 'php artisan storage:link' command has been executed, and if so, consider removing the web serving capability of the tool.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.kb.cert.org/vuls/id/650657 | CVE | Third Party Advisory |
| https://github.com/livewire-filemanager/filemanager | [email protected] | Product |
| https://hackingbydoing.wixsite.com/hackingbydoing/post/unauthenticated-rce-in-livewire-filemanager | [email protected] | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| livewire-filemanager filemanager | < 1.0.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 23, 2026 | Initial Analysis | [email protected] |
| Jan 16, 2026 | CVE Modified | CISA-ADP |
| Jan 16, 2026 | CVE Modified | CVE |
| Jan 16, 2026 | New CVE Received | [email protected] |