CVE-2025-14894VulnerabilityPublished 16 Jan 2026

CVE-2025-14894: bee interactive Livewire Filemanager · Unrestricted File Upload

Affects bee interactive Livewire FilemanagerSource CVE Database V5

Not known to be exploited · CVSS 7.5 High : upgrade to 1.0 soon.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.6% chance of exploitation in 30 days – higher than 49% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 1.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 16 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade bee interactive Livewire Filemanager to 1.0.

Affected software

Product	Affected	Fixed in
bee interactiveLivewire Filemanager	Affected <1.0	Fixed in 1.0
GitHublivewire-filemanager/filemanager`pkg:github/livewire-filemanager/filemanager`Other threats	Affected =0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

To mitigate this vulnerability, organizations should immediately audit their use of the Livewire Filemanager component within Laravel applications. Specific steps include: 1) Implement strict server-side validation of file types and MIME types before accepting uploads, explicitly blocking executable file extensions such as .php, .phtml, .php3, etc. 2) Restrict web server access to the storage directory or configure it to prevent execution of uploaded files, for example, by disabling PHP execution in the storage path via web server configuration (e.g., using .htaccess or nginx directives). 3) Employ application-level whitelisting of allowed file types and enforce size limits. 4) Monitor web server logs for suspicious file upload attempts or access to unexpected file types in the storage directory. 5) If possible, isolate file upload functionality in a sandboxed environment or separate domain/subdomain to limit impact. 6) Keep Laravel and all related components up to date and watch for official patches from bee interactive. 7) Conduct penetration testing focused on file upload mechanisms to identify similar weaknesses. These measures go beyond generic advice by focusing on configuration hardening and proactive monitoring tailored to this vulnerability's exploitation method.

Description

CVE-2025-14894 is a high-severity vulnerability in the bee interactive Livewire Filemanager used in Laravel applications. The vulnerability arises from the lack of file type and MIME validation in LivewireFilemanagerComponent.php, allowing attackers to upload malicious PHP files. These files can then be executed via the /storage/ URL if the Laravel application has been set up in a common manner. This results in remote code execution (RCE) without requiring authentication or user interaction. Although no known exploits are currently in the wild, the vulnerability poses a significant risk due to its ease of exploitation and potential impact. Organizations using this component should urgently review their file upload handling and apply mitigations. European organizations using Laravel with this file manager are particularly at risk, especially in countries with high Laravel adoption and active web development sectors.

Impact

For European organizations, the impact of CVE-2025-14894 can be severe. Successful exploitation leads to remote code execution, allowing attackers to run arbitrary commands on the affected server. This can result in data breaches, unauthorized access to sensitive information, defacement of websites, or use of compromised servers as a foothold for further attacks within the network. Organizations handling personal data under GDPR could face regulatory penalties if breaches occur. The vulnerability affects web-facing applications, increasing the risk of exploitation by external threat actors. Given Laravel's popularity in Europe, especially among SMEs and startups, the attack surface is significant. The lack of authentication and user interaction requirements lowers the barrier for attackers, potentially leading to widespread exploitation if the vulnerability is weaponized. Critical infrastructure or high-value targets using this component could face operational disruptions or reputational damage.

Summary

The vulnerability identified as CVE-2025-14894 affects the bee interactive Livewire Filemanager, a component commonly integrated into Laravel-based web applications for managing file uploads. The core issue lies in the LivewireFilemanagerComponent.php script, which fails to validate the file type and MIME type of uploaded files. This lack of validation allows an attacker to upload files with dangerous extensions, such as PHP scripts, which can then be accessed and executed through the web server via the /storage/ URL path. This scenario assumes that the Laravel application has been configured following a common setup process that exposes the storage directory to web access. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), which is a well-known vector for remote code execution (RCE) attacks. The CVSS v3.1 base score of 7.5 reflects a high severity, with an attack vector that is network-based, requires no privileges, no user interaction, and impacts confidentiality by potentially allowing attackers to execute arbitrary code on the server. Although no public exploits have been reported yet, the vulnerability's characteristics make it a critical concern for web applications relying on this file manager. The absence of patch links suggests that a fix may not yet be publicly available, emphasizing the need for immediate mitigation efforts by affected parties.

CWE-434Unrestricted Upload of File with Dangerous Type (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #12OWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Architecture and Design
Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.
Architecture and Design · Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
Architecture and Design
Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.
OWASP Cheat Sheets
Server Side Request Forgery Prevention (opens in a new tab)
Web Service Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
File Upload (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V12.5.2 (opens in a new tab)
V13.1.5 (opens in a new tab)
V12.2.1 (opens in a new tab)
Attack patterns
Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 23 Jan 2026, 20:34 UTC

WeaknessesCWE-434

Technical details

References

Community reviews

Related threats