Livewire vulnerabilities
We track 3 vulnerabilities in Livewire products across 2 products. 3 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on July 17, 2025.
Latest Livewire vulnerabilities
- 9.8 Critical severity
Laravel Livewire Code Injection Exploited
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates a
- 9.3 Critical severity
Volt is an elegantly crafted functional API for Livewire.
Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0.
- 9.8 Critical severity
livewire: Unrestricted Upload of File with Dangerous Type
Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual fil