CVE-2025-14894 is a critical (9.8) unrestricted file upload in Livewire Filemanager, a Laravel package. It does not validate file type or MIME, so a PHP file can be uploaded and run through the /storage/ URL. CERT/CC reports no vendor response, so add your own validation or remove the package.
What's affected
The record and CERT/CC advisory VU#650657 describe LivewireFilemanagerComponent.php, which does not check file type or MIME. The package is described as commonly used in Laravel applications. Exploitation depends on a common Laravel setup step being done, which makes the upload directory reachable through the /storage/ URL.
The advisory lists no affected or fixed version range. CERT/CC says the vendor has not acknowledged the vulnerability, and that Bee Interactive, Laravel and Laravel Swiss were notified without a statement. Treat all versions as affected unless you can confirm otherwise.
The CVSS vector is AV:N/AC:L/PR:N/UI:N, high on all impact measures.
How to check if you're exposed
Check whether the package is installed and how storage is exposed.
composer show | grep -i filemanager
grep -i filemanager composer.lock
ls -la public/storage
CERT/CC suggests checking whether php artisan storage:link has been run. That command links the storage directory into the public folder, which is how files in it become reachable from the web. If the link exists and Livewire Filemanager stores uploads there, uploaded files can be requested directly.
Also list the files stored by the package and look for anything that is not a normal document or image, especially files ending in script extensions. You can paste your lock file into the free scan at gold.safeguard.sh/scan.
What to do now
- Find every Laravel application that uses Livewire Filemanager.
- Require authentication and authorization for every route that reaches the file manager.
- Add your own file type, extension and content validation. CERT/CC notes the package treats validation as out of scope and tells users to add their own.
- Make sure the web server does not execute PHP from storage paths, and consider removing the public storage link for this package, as CERT/CC suggests.
- Inspect stored files for scripts. If you find any, treat the server as compromised and rotate keys, including the Laravel application key.
- Consider replacing the package with a maintained alternative if the vendor stays silent.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. Two normal settings combine into a risk, an upload component that accepts any file and a storage link that exposes uploads to the web. Neither looks wrong alone.
No vendor fix means the responsibility moves to you. Put validation in front of the component, restrict who may use it and make sure uploads can never run as code. A file manager is a powerful feature, so treat it as an admin tool, not a public one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version?
Not that CERT/CC could confirm. The vendor has not acknowledged the issue, so add your own validation or remove the package.
What does storage:link do?
It links the storage directory into the public folder so files in it can be requested through the /storage/ URL. CERT/CC says the attack depends on that setup.
Sources
Last reviewed: 19 October 2026.
