Loading vulnerability…
CVE-2025-14894 is a high-severity unrestricted file upload vulnerability in Livewire Filemanager, a file management component used in Laravel applications. The issue is attributed to LivewireFilemanagerComponent.php not enforcing file type and MIME validation on uploaded content. As a result, an attacker can upload a malicious PHP file, including a webshell, through the application’s file upload functionality. In deployments where Laravel’s public storage symlink has been enabled through the commonly used php artisan storage:link setup step, the uploaded file becomes reachable under the publicly accessible /storage/ path and can then be directly executed by requesting its URL. This results in unauthenticated remote code execution on the vulnerable server in the context of the web server process.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
php artisan storage:link has been executed. If possible, disable the public storage link and prevent direct web access to uploaded files. Enforce strict server-side validation of upload types using both extension and MIME allowlists, reject executable content, and configure the web server so PHP or other executable handlers are disabled in upload and storage directories. Storing uploads outside the web root and serving them indirectly is strongly recommended until a vendor fix is available.Patch, then assume compromise.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Unpatched Livewire Filemanager vulnerability allowing upload of malicious PHP files to a web-accessible directory and subsequent execution, resulting in unauthenticated arbitrary code execution.
An unauthenticated remote code execution vulnerability in Livewire Filemanager for Laravel, caused by insufficient file type/MIME validation that allows uploading executable PHP files into a web-accessible storage path.
An unauthenticated remote code execution vulnerability in Livewire Filemanager for Laravel caused by missing file type/MIME validation on uploads, enabling attackers to upload a malicious PHP file and execute it (notably when Laravel storage is publicly served via php artisan storage:link).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.