PT-2026-3246 · Unknown+1 · Livewire Filemanager+1

Published 2026-01-16 · Updated 2026-03-06 · CVE-2025-14894

Positive Technologies · (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Livewire Filemanager (affected versions not specified)

Description Livewire Filemanager, commonly used in Laravel applications, contains a flaw in LivewireFilemanagerComponent.php where it does not perform adequate file type and MIME validation. This allows for the upload of malicious PHP files. If Laravel storage linking is enabled, these files can be executed via the /storage/ URL, leading to Remote Code Execution (RCE) as the web-server user. Successful exploitation can result in full server compromise and potential lateral movement within the infrastructure. The issue affects Laravel web applications globally.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2026-00912

CVE-2025-14894

GHSA-9G95-48C6-R778

Affected Products

Laravel

Livewire Filemanager

References · 26

• https://bdu.fstec.ru/vul/2026-00912 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14894 · Security Note
• https://osv.dev/vulnerability/GHSA-9g95-48c6-r778 · Vendor Advisory
• https://github.com/livewire-filemanager/filemanager/blob/master/docs.md#security · Note
• https://github.com/livewire-filemanager/filemanager · Note
• https://twitter.com/ThreatSynop/status/2013344575981568279 · Twitter Post
• https://twitter.com/ThreatSynop/status/2013328478549004569 · Twitter Post
• https://twitter.com/Komodosec/status/2026326915561513396 · Twitter Post
• https://advisories.gitlab.com/pkg/composer/livewire-filemanager/filemanager/CVE-2025-14894 · Note
• https://twitter.com/Karma_X_Inc/status/2013136011857985808 · Twitter Post
• https://twitter.com/ThreatSynop/status/2013332868206883193 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2012202410127536165 · Twitter Post
• https://dbugs.ptsecurity.com/vulnerability/CVE-2025-14894 · Note
• https://kb.cert.org/vuls/id/650657 · Note