The mckenziearts/livewire-markdown-editor package versions prior to 1.3 contain a critical arbitrary file upload vulnerability in the MarkdownEditor::updatedAttachments() handler. Authenticated users can upload files of any type without server-side validation, leading to stored XSS, phishing page hosting, malware distribution, and markdown injection via crafted filenames. The vulnerability is fixed in version 1.3. Immediate mitigation includes disabling the upload UI by setting :show-upload="false".