CVE-2025-14894: CVE-2025-14894

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-16 · updated 2026-06-17
Weakness: CWE-434

Description

Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.

Affected products

bee interactive Livewire Filemanager: before 1.0.0 — fixed in 1.0.0

How to fix

Upgrade to a fixed version: bee interactive Livewire Filemanager 1.0.0. Check the vendor advisory for mitigations.

References

https://github.com/livewire-filemanager/filemanager
https://hackingbydoing.wixsite.com/hackingbydoing/post/unauthenticated-rce-in-livewire-filemanager
https://www.kb.cert.org/vuls/id/650657

Get alerted when CVE-2025-14894 or the next vulnerability affects your stack