Vulnerability · Published Jan 16, 2026 · Assigned by certcc
CVE-2025-14894CVE-2025-14894
High 7.5
In plain English
A high-severity security flaw in Livewire Filemanager from bee interactive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 50.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | livewire-filemanager/filemanager | no fix listed | GHSA-9g95-48c6-r778 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bee interactive | Livewire Filemanager | 0 – before 1.0 |