9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-14894

CVE-2025-14894: CVE-2025-14894

Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-14894

CVE-2025-14894:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
livewire-filemanager/filemanager	composer	<= 1.0.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the livewire-filemanager/filemanager package due to a lack of file type validation during uploads. The analysis of the source code, specifically the src/Livewire/LivewireFilemanagerComponent.php file, reveals that the updatedFiles method is the entry point for file uploads. This method is a Livewire lifecycle hook that triggers when the files property is updated. Inside this method, the code iterates over the uploaded files and saves them without checking their extension or MIME type. This allows an attacker to upload a PHP file (e.g., shell.php). If the Laravel application's storage has been linked to be publicly accessible (a common practice using php artisan storage:link), the uploaded script can be accessed via a URL, leading to Remote Code Execution (RCE). The vulnerable function is LivewireFilemanagerComponent::updatedFiles because it directly processes the uploaded files without proper security checks.

Vulnerable functions

LivewireFilemanagerComponent::updatedFiles

src/Livewire/LivewireFilemanagerComponent.php

The `updatedFiles` method is responsible for handling file uploads. It iterates through the uploaded files and uses the `addMedia` method to store them. The method lacks any file type or MIME validation, allowing any type of file to be uploaded, including malicious PHP scripts. The filename is sanitized, but the original extension is preserved, which allows the uploaded script to be executed by the server.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.