CVE-2025-14894
CriticalSummary
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
Risk Assessment
An attacker can upload a malicious PHP file and execute it on the server, potentially leading to full compromise of the application and server.
Recommendation
Update Livewire Filemanager to the latest patched version and ensure file type validation is enabled.
Original NVD description (English source)
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.