GHSA-9g95-48c6-r778
Livewire Filemanager does not restrict uploaded file types
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | livewire-filemanager/filemanager | <= 1.0.4 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-14894
- https://github.com/livewire-filemanager/filemanager
- https://github.com/livewire-filemanager/filemanager/blob/master/docs.md#security
- https://hackingbydoing.wixsite.com/hackingbydoing/post/unauthenticated-rce-in-livewire-filemanager
- https://www.kb.cert.org/vuls/id/650657