Filemanager
CVE-2025-14894
CRITICAL
GHSA-9g95-48c6-r778
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8 — affects any Laravel application using Livewire Filemanager. Upload-to-RCE is a straightforward exploitation path. |
| Exploit ScenarioDerived | An attacker uploads a PHP reverse shell disguised as an image through the Livewire Filemanager component, then accesses the uploaded file via its public URL to gain command execution on the Laravel server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Livewire Filemanager for Laravel contains an unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary files on the server.
Earlier versions of this analysis (1)
Unrestricted file upload in Livewire Filemanager enables RCE on Laravel applications.
RemediationAI
Update Livewire Filemanager. Implement server-side file type validation. Store uploads outside the web root. Disable PHP execution in upload directories.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LivewireFilemanagerComponent.php does not properly validate uploaded file types (CWE-434), allowing attackers to bypass restrictions and upload executable PHP files that are then accessible via the web server.
Know when Filemanager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
Executive ViewAI
CVE-2025-14894 presents critical security risk, a unrestricted file upload vulnerability rated CVSS 9.8. This could allow attackers to access or modify files outside intended directories, potentially exposing sensitive configuration or credentials. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict file upload functionality via WAF; (2) Implement allowlist-based file type validation; (3) Use chroot/containerization to limit filesystem access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB