CVE-2025-14894
High · 7.5Livewire Filemanager does not restrict uploaded file types
CVSS
7.5
EPSS
0.6%
Published
Jan 16, 2026
CISA due date
—
The record
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | livewire-filemanager/filemanager | 0 | No fix |
Related vulnerabilities
- GHSA-9g95-48c6-r778 Livewire Filemanager does not restrict uploaded file types Same vulnerability
- CVE-2026-38739 ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CWE-937
- CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta CWE-937
- CVE-2026-47255 AgenticMail API/storage and outbound relay hardening fixes CWE-937
- CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections… CWE-937
- CVE-2026-47695 CC-Tweaked has an SSRF Protection Bypass with NAT64 CWE-937
- GHSA-7cwm-fpfh-rrch Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces CWE-937
- GHSA-hfc8-w5f4-3x6m Ironic Standalone Operator's controller modifies user-owned resources without consent CWE-937