CVE-2025-14894
📋 TL;DR
CVE-2025-14894 is an unauthenticated remote code execution vulnerability in Livewire Filemanager for Laravel applications. Attackers can upload malicious PHP files without validation and execute them via the /storage/ URL, leading to complete system compromise. All Laravel applications using vulnerable versions of Livewire Filemanager are affected.
💻 Affected Systems
- Livewire Filemanager
📦 What is this software?
Filemanager by Livewire Filemanager
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining shell access, installing backdoors, stealing data, and pivoting to internal networks.
Likely Case
Webshell deployment leading to data exfiltration, credential theft, and lateral movement within the application environment.
If Mitigated
Attack blocked at file upload stage with proper validation, limiting impact to failed upload attempts.
🎯 Exploit Status
Exploitation requires no authentication and uses simple file upload techniques with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub repository for latest patched version
Vendor Advisory: https://github.com/livewire-filemanager/filemanager
Restart Required: No
Instructions:
Update Livewire Filemanager to latest version via composer: composer update livewire-filemanager/filemanager
Verify file upload validation is now enforced in LivewireFilemanagerComponent.php
🔧 Temporary Workarounds
Disable public storage symlink
allRemove or restrict access to Laravel's public storage directory to prevent file execution via web
Remove symlink: rm public/storage
Or configure web server to block access to /storage/ path
Implement file upload validation middleware
allAdd server-side validation to block PHP file uploads before they reach Livewire Filemanager
Create Laravel middleware to validate file MIME types and extensions
Apply middleware to file upload routes
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block PHP file uploads and /storage/ directory access
- Disable file upload functionality entirely in Livewire Filemanager configuration
🔍 How to Verify
Check if Vulnerable:
Check if LivewireFilemanagerComponent.php lacks file type/MIME validation and if /storage/ URL is publicly accessibleCheck Version:
composer show livewire-filemanager/filemanager | grep versionVerify Fix Applied:
Attempt to upload PHP file - should be rejected. Check that file validation code exists in component.📡 Detection & Monitoring
Log Indicators:
- PHP file upload attempts to filemanager endpoints
- Unusual file creations in storage/app/public directory
- HTTP requests to /storage/*.php paths
Network Indicators:
- Outbound connections from web server to unknown IPs following file uploads
- Large data exfiltration from storage directories
SIEM Query:
source="web_logs" AND (uri="/storage/*.php" OR (method="POST" AND uri CONTAINS "filemanager" AND user_agent CONTAINS "curl" OR "wget"))