CVE-2025-14894

CVE-2025-14894 affects Livewire Filemanager, a component commonly used in Laravel applications. This critical vulnerability (CVSS 9.8) stems from inadequate file type and MIME validation in LivewireFilemanagerComponent.php, enabling unauthenticated remote code execution (RCE) by uploading and executing malicious PHP files. Exploitation is possible if a common Laravel setup allows access to the /storage/ URL. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating high awareness despite its inactive status on the CISA KEV list.