Unpatched RCE: Livewire Filemanager Upload Flaw (CVE-2025-14894) Exposes Laravel Apps

A critical new flaw has been uncovered in Livewire Filemanager, a component used within the Laravel PHP framework, tracked as CVE-2025-14894 with a CVSS of 7.5. The vulnerability stems from inadequate validation of uploaded data, allowing an unauthenticated attacker to upload a malicious PHP script and trigger remote code execution if the server serves those files publicly, such as when storage links are exposed.

According to CERT/CC, the issue arises from how the component handles file types and MIME validation, with a standard attack scenario involving a disguised PHP file. The exploit can grant an attacker unauthenticated remote code execution as the web server user, enabling full read and write access to files accessible to that user and potential lateral movement. As of the advisory’s release, there is no official patch, and the vendor has not acknowledged the vulnerability.

CERT/CC recommends defenders verify whether their applications serve storage files publicly and consider removing web serving capabilities for the tool if the php artisan storage:link command has been used. 19 January 2026.