PT-2025-29947 · Livewire · Livewire

Caleb Porzio · Published 2025-07-17 · Updated 2026-05-05 · CVE-2025-54068

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Livewire versions 3.0.0 through 3.6.3

Description An issue in the Livewire full-stack framework for Laravel allows unauthenticated attackers to achieve remote command execution in specific scenarios. The problem arises from unsafe object unmarshaling during the hydration of certain component property updates. Exploitation requires a component to be mounted and configured in a particular way but does not require user interaction. Real-world incidents include the creation of spam pages, unauthorized redirects for SEO manipulation, and the installation of cryptocurrency miners on affected servers.

Recommendations Update Livewire to version 3.6.4 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-05933

CVE-2025-54068

GHSA-29CQ-5W36-X7W3

Affected Products

Livewire

References · 80

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54068.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54068 · Security Note
• https://osv.dev/vulnerability/GHSA-29cq-5w36-x7w3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54068 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05933 · Security Note
• https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 · Security Note, Vendor Advisory
• https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc · Security Note, Patch
• https://github.com/livewire/livewire/releases/tag/v3.6.4 · Note
• https://github.com/livewire/livewire · Note
• https://github.com/synacktiv/Livepyre · Note
• https://reddit.com/r/CVEWatch/comments/1s0hsn4/top_10_trending_cves_22032026 · Reddit Post
• https://twitter.com/fridaysecurity/status/1947094745710199219 · Twitter Post
• https://twitter.com/Komodosec/status/1960357207268278401 · Twitter Post
• https://twitter.com/devnzian/status/2041801429950853537 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1qmg9sb/top_10_trending_cves_25012026 · Reddit Post