Loading story…
A high-severity vulnerability in Livewire Filemanager, a file-management component used in Laravel web applications, allows unauthenticated remote code execution via malicious file upload. Tracked as CVE-2025-14894 (CERT/CC note VU#650657; reported CVSS 7.5), the issue stems from inadequate file-type and MIME validation in LivewireFilemanagerComponent.php, enabling attackers to upload a PHP payload (e.g., a webshell) through the component’s upload interface.
Exploitation is straightforward in common Laravel deployments: if the application exposes uploaded content through the public /storage/ path—typically after running the standard setup command php artisan storage:link—an attacker can upload a malicious PHP file and then trigger execution by requesting it via the storage URL. Successful exploitation runs code with the privileges of the web server user, enabling broad read/write access to accessible files and potential pivoting to connected systems; at the time of reporting, the issue was described as unpatched/unacknowledged by the vendor, with the project’s documentation reportedly treating file validation as “out of scope” for the component itself.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
At the time of disclosure, no official patch was available for CVE-2025-14894 and the vendor had not acknowledged the vulnerability, according to the advisory coverage. This left defenders reliant on configuration changes and upload restrictions as interim mitigations.
The disclosure explained that Laravel deployments exposing uploaded files through the public /storage/ path, commonly after using `php artisan storage:link`, can allow execution of uploaded PHP payloads as the web server user. CERT/CC recommended mitigations including disabling public serving of storage, enforcing strict allowlisted upload validation, and storing uploads outside web-accessible directories.
On 2026-01-16, CERT/CC disclosed CVE-2025-14894 (VU#650657), a vulnerability in Livewire Filemanager that can allow unauthenticated remote code execution through malicious file uploads. The issue was attributed to missing file type and MIME validation, which can let attackers upload PHP payloads disguised as benign files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity file upload vulnerabilities have been disclosed in Laravel ecosystem components used for content and file management. **Sharp** versions prior to `9.20.0` are affected by `CVE-2026-33687`, which lets authenticated users bypass upload restrictions by tampering with a client-controlled `validation_rule` parameter so the server accepts files without intended MIME type or extension checks. The issue was fixed in `9.20.0` by removing client-side control over validation and enforcing checks server-side; the advisory also notes risk is reduced when uploads are stored on a strictly private disk and that default setups do not directly execute uploaded PHP files unless a public disk is configured. A separate disclosure, `CVE-2019-25673`, affects **UniSharp Laravel File Manager** `v2.0.0-alpha7` and `v2.0`, where authenticated attackers can submit multipart uploads with the `type` parameter set to `Files`, upload malicious PHP content, and then trigger **arbitrary code execution** by accessing the uploaded file from the working directory path. Both issues are classified as `CWE-434` unrestricted file upload flaws and carry high-impact severity scores, underscoring the risk that authenticated upload features in Laravel-based management tools can be abused to place attacker-controlled files on servers.
Jun 29, 2026
A large-scale credential theft campaign exploited `CVE-2025-54068`, a critical unauthenticated remote code execution flaw in Laravel Livewire v3 through 3.6.3, compromising more than 6,000 applications. Imperva said the attackers used PHP deserialization payloads built with PHPGGC gadget chains to fetch and run a Bash stealer known as `shoc.enz` from `xantibot[.]pw`, then harvested `.env` files and other sensitive data from exposed servers. Recovered attacker infrastructure showed credentials stolen from 6,167 distinct applications, along with more than 1,850 database dumps and over 26 million email addresses spanning multiple countries and sectors. The malware collected database credentials, `APP_KEY` values, Stripe keys, AWS IAM credentials, JWT and OAuth secrets, and SMTP passwords, then exfiltrated data via FTP, Telegram, and GoFile; reporting also noted separate research into large-scale compromises of thousands of WordPress sites by a Chinese actor, underscoring continued mass exploitation of widely deployed web platforms.
Jun 29, 2026
A **critical vulnerability in the WordPress plugin *WPvivid Backup & Migration*** (aka *Migration, Backup, Staging – WPvivid Backup & Migration*) allows **unauthenticated arbitrary file upload leading to remote code execution (RCE)** on affected sites. Tracked as **CVE-2026-1357** with **CVSS 9.8**, the issue impacts plugin versions **<= 0.9.123** and is tied to the plugin’s remote transfer functionality (`send_to_site()` / `wpvivid_action=send_to_site`), which processes incoming backup data from other sites. Technical details indicate the exploit chain combines **broken cryptographic error handling** with **unsafe file write behavior**: when `openssl_private_decrypt()` fails, execution continues and a `false` value is passed into AES initialization, which is treated as a predictable **null-byte key**. Attackers can craft payloads encrypted with this null-byte key to bypass intended protections, then leverage missing file validation (and reported lack of filename/path sanitization enabling **directory traversal**) to write attacker-controlled files (e.g., PHP web shells) into web-accessible locations, enabling full site takeover and data access (including database contents).
Jun 29, 2026