CVE-2025-14894

Katalog CVE

CVSS 9.8 · Critical EPSS 0,62%

Kerentanan Unrestricted Upload of File with Dangerous Type pada livewire-filemanager filemanager. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.

Rincian

Terbit di NVD

16 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.kb.cert.org/vuls/id/650657 advisory pihak ketiga
• https://github.com/livewire-filemanager/filemanager product
• https://hackingbydoing.wixsite.com/hackingbydoing/post/unauthenticated-rce-in-livewire-filemanager not applicable