CVE-2025-54068: Livewire is vulnerable to remote command execution during component property update hydration
N/A
CVSS Score
Basic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
7/17/2025
Updated
7/17/2025
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
-
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| livewire/livewire | composer | >= 3.0.0-beta.1, < 3.6.4 | 3.6.4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability lies in the hydrateForUpdate method within the Livewire\Mechanisms\HandleComponents\HandleComponents class. The provided patch clearly shows that the logic for handling property updates within this function was changed. Previously, it directly called the hydrate method. The fix introduces a new method, hydratePropertyUpdate, which contains an added security check to prevent the hydration of removed nested properties. The hydrateForUpdate function is modified to call this new, safer method. This indicates that the original implementation of hydrateForUpdate was the source of the remote command execution vulnerability.
Vulnerable functions
Livewire\Mechanisms\HandleComponents\HandleComponents.hydrateForUpdatesrc/Mechanisms/HandleComponents/HandleComponents.php
The `hydrateForUpdate` function was vulnerable because it called the generic `hydrate` method to process property updates. This was insecure as it lacked specific checks for handling nested property removals (`__rm__`), creating a vector for remote command execution. The patch mitigates this by redirecting the property update hydration to a new, more secure method, `hydratePropertyUpdate`, which includes the necessary security checks.