{"id":"CVE-2024-47823","published":"2024-10-08T17:48:36Z","modified":"2025-07-17T18:22:08Z","title":"Livewire Remote Code Execution (RCE) on File Uploads","vendor":"livewire","product":"livewire","tier":"tail","description":{"text":"Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., `image/png`) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack: 1. Filename is composed of the original file name using `$file->getClientOriginalName()`. 2. Files stored directly on your server in a public storage disk. 3. Webserver is configured to execute “.php” files. This issue has been addressed in release versions `2.12.7` and `3.5.2`. All users are advised to upgrade. There are no known workarounds for this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00846,"percentile":0.57972,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://github.com/livewire/livewire/security/advisories/GHSA-f3cx-396f-7jqp","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/livewire/livewire/pull/8624","tags":["x_refsource_MISC"]},{"url":"https://github.com/livewire/livewire/commit/70503b79f5db75a1eac9bf55826038a6ee5a16d5","tags":["x_refsource_MISC"]},{"url":"https://github.com/livewire/livewire/commit/cd168c6212ea13d13b82b3132485741f82d9fad9","tags":["x_refsource_MISC"]}],"priority":{"score":22.0,"factors":[{"name":"EPSS percentile","points":11.59},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.39}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-04-10","earliestUrl":"https://github.com/HelgeSverre/livewire-honeypot","repos":[{"name":"HelgeSverre/livewire-honeypot","url":"https://github.com/HelgeSverre/livewire-honeypot","stars":8,"created":"2026-04-10"}]},"first":{"date":"2026-04-10","source":"PoC-in-GitHub","url":"https://github.com/HelgeSverre/livewire-honeypot"},"provenance":"source"},"vendorSlug":"livewire","affectedVersions":[{"vendor":"livewire","product":"livewire","versions":[">= 3.0.0-beta.1, < 3.5.2","< 2.12.7"]}],"affected":[{"ecosystem":"Packagist","package":"livewire/livewire","vulnerableRanges":[">=3.0.0-beta.1, <3.5.2","<2.12.7"],"patched":["3.5.2","2.12.7"],"from":["GHSA-f3cx-396f-7jqp"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3024","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-21504","published":"2024-03-19","fixed":"3.4.9","kev":false,"link":{"from":"CVE-2024-21504","to":"CVE-2024-47823","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:livewire/livewire","fromFixed":"3.4.9","toFixed":"3.5.2","daysApart":203}]}},{"cve":"CVE-2024-47823","published":"2024-10-08","fixed":"3.5.2","kev":false},{"cve":"CVE-2025-54068","published":"2025-07-17","fixed":"3.6.4","kev":true,"link":{"from":"CVE-2024-47823","to":"CVE-2025-54068","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:livewire/livewire","fromFixed":"3.5.2","toFixed":"3.6.4","daysApart":282}]}},{"cve":"CVE-2026-81887","published":"2026-08-31","fixed":"4.3.4","kev":false}],"package":"Packagist:livewire/livewire"}}