Livewire vulnerabilities

2 known vulnerabilities in Livewire from Laravel. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  livewire: Unrestricted Upload of File with Dangerous Type

  CVE-2024-47823Oct 8, 2024Livewire

  Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual fil

• 8.8 High severity

  Livewire: Cross-Site Request Forgery

  CVE-2024-22859Feb 1, 2024Laravel

  Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the vendor disputes this because the 5d88731 commit fixes a usability problem (HTTP 419 status codes for l