← Vulnerability feed

Vulnerability record · CVE-2025-54068 · published 17 July 2025

CVE-2025-54068: Laravel Livewire v3 unauthenticated remote code execution via property hydration

Laravel · Livewire

Livewire v3 through v3.6.3 mishandles hydration of certain component property updates, allowing code injection. Unauthenticated attackers can achieve remote command execution when a component is mounted and configured in a specific way. The flaw is unique to Livewire v3 and is patched in v3.6.4.

9.2 CVSS 4.0 Critical CISA KEV since 20 Mar 2026 EPSS 97% · top 0.1% CWE-94 · Code injection
9.2CVSS 4.0 base score
97%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
5References
17 Jun 2026Last modified by NVD

Description

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 4.0 score of 9.2, KEV listing and near-certain EPSS probability makes this an urgent patch.

What it is

Livewire v3 through v3.6.3 mishandles hydration of certain component property updates, allowing code injection. Unauthenticated attackers can achieve remote command execution when a component is mounted and configured in a specific way. The flaw is unique to Livewire v3 and is patched in v3.6.4.

Impact

An attacker who reaches a suitably configured component can execute arbitrary commands on the server, leading to full compromise of the application and its data. No authentication or user interaction is needed.

Attack surface

Reachable over the network through Livewire component update requests; no authentication or user interaction is required. Exploitation is constrained to applications where a component is mounted and configured in the particular way the flaw requires.

Exploitation

CVE-2025-54068 is listed in CISA KEV with a due date of 2026-04-03, and EPSS gives a 30-day probability of 0.97072 (99.888th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is documented in the record.

What to do

  • Upgrade Livewire to v3.6.4 or later immediately; no workarounds are available.
  • Inventory all Laravel applications using Livewire v3 and confirm the running version.
  • Where immediate upgrade is not possible, restrict or disable exposed Livewire component endpoints until patched.
  • Monitor vendor advisory GHSA-29cq-5w36-x7w3 and CISA KEV guidance for updates.

Detection

  • Review web server and application logs for anomalous Livewire update requests, especially unexpected property payloads.
  • Alert on outbound network connections or child processes spawned by the PHP/web server process.
  • Hunt for signs of post-exploitation activity such as new files, scheduled tasks or modified application code on Laravel hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2025-54068 to the Known Exploited Vulnerabilities catalog on 20 March 2026 as "Laravel Livewire Code Injection Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 3 April 2026.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc Patch
https://github.com/livewire/livewire/releases/tag/v3.6.4 Release Notes
https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068 US Government Resource
https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas/ Third Party Advisory

Track CVE-2025-54068 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2024-22859Laravel livewire cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. N…EPSS 0.46%7.7CVE-2024-47823Laravel livewire improper input validation vulnerabilityLivewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and …EPSS 0.85%6.1CVE-2024-21504Laravel livewire cross-site scripting vulnerabilityVersions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a prope…EPSS 0.52%8.8CVE-2026-65660Microsoft sharepoint server code injection vulnerabilityImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.KEVEPSS 2.1%9.8CVE-2026-60004Gitea diffpatch API code injection enables remote code executionGitea before 1.27.1 allows remote code execution through the diffpatch API by way of Git hook installation. The flaw is a code injection issue (CWE-9…KEVEPSS 24%analysed9.5CVE-2026-72530TrueConf Server sandbox breakout via crafted script code injectionTrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5 and earlier allow a remote unauthenticated attacker to break o…KEVEPSS 1.7%analysed9.4CVE-2025-62593Ray browser-based RCE via insufficient User-Agent guardRay, an AI compute engine, contains a critical remote code execution flaw before version 2.52.0. Its defense against browser-based attacks relies on …KEVEPSS 62%analysed9.8CVE-2026-9198Langflow auto_login and code validation chain enables unauthenticated RCEIBM Langflow OSS 1.0.0 through 1.10.0 exposes /api/v1/auto_login, which mints SUPERUSER tokens to any network caller, and /api/v1/validate/code, whic…KEVEPSS 29%analysed

Source: NIST National Vulnerability Database (record CVE-2025-54068), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.