PT-2025-29947 · Livewire · Livewire

Caleb Porzio · Published 2025-07-17 · Updated 2026-03-22 · CVE-2025-54068

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Livewire versions 3.0.0-beta.1 through 3.6.3

Description Livewire, a full-stack framework for Laravel, has a flaw that allows unauthenticated attackers to execute commands remotely in certain situations. This issue arises from how component property updates are processed. Exploitation requires a specifically configured component but does not need user interaction or authentication. Reports indicate active exploitation of this issue, with attackers installing cryptocurrency miners on compromised servers and creating spam pages. The vulnerability does not affect versions prior to Livewire v3.

Recommendations Upgrade to Livewire version 3.6.4 or later immediately.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-54068

GHSA-29CQ-5W36-X7W3

Affected Products

Livewire

References · 67

• https://nvd.nist.gov/vuln/detail/CVE-2025-54068 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54068 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-29cq-5w36-x7w3 · Vendor Advisory
• https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 · Vendor Advisory, Security Note
• https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc · Patch, Security Note
• https://github.com/livewire/livewire/releases/tag/v3.6.4 · Note
• https://github.com/livewire/livewire · Note
• https://github.com/synacktiv/Livepyre · Note
• https://reddit.com/r/CVEWatch/comments/1r1ueiu/top_10_trending_cves_11022026 · Reddit Post
• https://twitter.com/r0otk3r/status/2010588788578570494 · Twitter Post
• https://reddit.com/r/Snipe_IT/comments/1m79jms/critical_livewire_rce · Reddit Post
• https://github.com/advisories/GHSA-29cq-5w36-x7w3 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1q9wp5q/top_10_trending_cves_11012026 · Reddit Post
• https://twitter.com/ynsmroztas/status/2014778501736313136 · Twitter Post
• https://threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas · Note