Livewire Filemanager Vulnerability Exposes Web Apps to Remote Code Execution

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Livewire Filemanager Vulnerability Enables RCE in Web Applications A critical vulnerability in Livewire Filemanager, tracked as CVE-2025-14894, allows unauthenticated remote code execution (RCE) on affected Laravel web applications. This flaw arises from improper file validation in the LivewireFilemanagerComponent.php component, putting numerous servers at risk. The vulnerability has been assigned CERT vulnerability note VU#650657. 3 sources 53