Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 16 Jan 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed. | |
| Title | CVE-2025-14894 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: certcc
Published:
Updated: 2026-01-16T12:43:14.264Z
Reserved: 2025-12-18T16:01:40.573Z
Link: CVE-2025-14894
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-16T13:16:11.220
Modified: 2026-01-16T13:16:11.220
Link: CVE-2025-14894
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.