Livewire Filemanager Vulnerability Exposes Web Applications to RCE Attacks

Cybersecuritynews •Abinaya • January 19, 2026

A significant security vulnerability has been discovered in Livewire Filemanager, a widely used file management component embedded in Laravel web applications. Tracked as CVE-2025-14894 and assigned vulnerability note VU#650657, the flaw enables unauthenticated attackers to execute arbitrary code on vulnerable servers. The vulnerability stems from improper file validation in the LivewireFilemanagerComponent.php component. The tool fails […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Livewire Filemanager Vulnerability Enables RCE in Web Applications A critical vulnerability in Livewire Filemanager, tracked as CVE-2025-14894, allows unauthenticated remote code execution (RCE) on affected Laravel web applications. This flaw arises from improper file validation in the LivewireFilemanagerComponent.php component, putting numerous servers at risk. The vulnerability has been assigned CERT vulnerability note VU#650657. 3 sources 53

Extracted Entities

Attack Types (1)

Remote Code Execution

CVEs (1)

CVE-2025-14894