IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-01-16 13:16

MODIFIED

2026-01-16 13:16

EPSS (Prob. Exploit)

0.62%

Top 50.0%

DATA SOURCES:

NVD 🔗 2026-01-16 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-9g95-48c6-r778 HIGH

Livewire Filemanager does not restrict uploaded file types

AFFECTED PACKAGES:

COMPOSER / livewire-filemanager/filemanager

<= 1.0.4

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

CVE-2025-14894

AFFECTED PACKAGES:

Unknown / Unknown

18 versions affected

ALIASES:

GHSA-9g95-48c6-r778

> HISTORIQUE DES MODIFICATIONS

Première apparition

16/01/2026 13:16

Source: NVD

📊 ENRICHISSEMENT 19/01/2026 17:39

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui

Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/livewire-filemanager/filemanager

https://hackingbydoing.wixsite.com/hackingbydoing/post/unauthenticated-rce-in-li...