CVE-2025-54068
criticalPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.963 · 100. PerzentilExploit · PoCEURUUShinzugefügt 2026-03-20beheben bis 2026-04-03
erforderliche Maßnahme Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS · bewertet 2026-10-22
Laravel Livewire Code Injection Vulnerability
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (7)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- flame-11/CVE-2025-54068-livewireflame-11/CVE-2025-54068-livewirePoC · poc_in_github
betroffene Produkte (4)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-29cq-5w36-x7w3Livewire is vulnerable to remote command execution during component property update hydration2025-07-17ghsa · osvUS
### Impact In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. ### Patches This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. ### Workarounds There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately. ### Resources No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (13)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dccnnvd
- https://github.com/livewire/livewire/releasesPatchcnnvd
- https://github.com/livewire/livewire/releases/tag/v3.6.4cnnvd
- https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-54068cnnvd
- https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dcenisa_euvd
- https://github.com/livewire/livewire/releases/tag/v3.6.4enisa_euvd
- https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan