CVE-2025-54068: Laravel Livewire Code Injection Vulnerability
Laravel · Livewire
Vendor fix available · Affected: Laravel Livewire · Exploitation: in CISA KEV since 20 Mar
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue20 Mar
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public7 public GitHub repositories (unverified), listed by PoC-in-GitHub23 Dec 2025
- Not established: not seen
Higher than 99% of scored CVEs
Federal deadline
CISA KEV · added 20 Mar · catalogue entry
Passed 225 days ago
DescriptionNVD
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
- CISA KEV
- Listed since 20 Mar · catalogue entry
- Public check
- Laravel Livewire v3 - Remote Command Execution · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- livewire
- Published
- July 2025
What changed
- CISA added it to the KEV catalogue CISA
- PoC-in-GitHub lists 7 public GitHub repositories (unverified) PoC-in-GitHub
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage6 articles · 4 outlets
First in our coverage: CISA, 20 Mar.
- Fri 20 Mar, 15:52 UTC. CISA, first report. CISA Adds CVE-2025-54068 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
- Fri 20 Mar, 16:23 UTC. CISA. CISA Adds CVE-2025-54068 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
- Fri 20 Mar, 16:55 UTC. CISA. CISA Adds Five Known Exploited Vulnerabilities to Catalog. Cites a CVE in CISA KEV.
- Sat 21 Mar, 09:11 UTC. The Hacker News, its first report on the story. CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026. Cites a CVE in CISA KEV.
- Sun 22 Mar, 15:13 UTC. Security Affairs, its first report on the story. U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
- Thu 25 Jun, 03:32 UTC. SecurityOnline, its first report on the story. Laravel Livewire Vulnerability Exposes Over 6,000 Apps. Cites a CVE in CISA KEV.
- Laravel Livewire Vulnerability Exposes Over 6,000 AppsSecurityOnline
- U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026The Hacker News · mentions it in passing
- CISA Adds Five Known Exploited Vulnerabilities to CatalogCISA · official notice · mentions it in passing
- CISA Adds CVE-2025-54068 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- CISA Adds CVE-2025-54068 to Known Exploited Vulnerabilities CatalogueCISA · official notice · first in our coverage
New articles also arrive in the RSS feed.