CVE-2025-54068
Laravel Livewire Code Injection Vulnerability
Description
CVE-2025-54068 is a CRITICAL code injection vulnerability in Laravel Livewire, carrying a CVSS 3.1 score of 9.8. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution. The issue stems from how certain component property updates are hydrated, a mechanism unique to Livewire v3. Exploitation requires a component to be mounted and configured in a particular way. The vulnerability is classified under CWE-94 (Code Injection). This CVE was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-03-20 with a remediation deadline of 2026-04-03. With an EPSS score of 48.851% (97.7th percentile), this vulnerability is among the most likely to be exploited across all tracked vulnerabilities. No ransomware association has been confirmed. Affected versions include Livewire >= 3.0.0 < 3.6.4.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| laravel | livewire | >= 3.0.0, < 3.6.4 |
References
- https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc(Patch)
- https://github.com/livewire/livewire/releases/tag/v3.6.4(Release Notes)
- https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068(US Government Resource)
- https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas/(Third Party Advisory)
Weakness Type
CWE-94: Improper Neutralization of Directives in Dynamically Evaluated Code (Code Injection)
CVE-2025-54068 is classified under CWE-94 — Code Injection. This weakness occurs when software constructs all or part of a code segment using externally-influenced input but does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code.
In the context of Laravel Livewire, this vulnerability arises from the hydration mechanism used to process component property updates in Livewire v3. Hydration is the process by which Livewire deserializes client-side state back into server-side PHP objects. When this deserialization process does not properly validate or sanitize the incoming data, attackers can inject malicious code that gets executed on the server.
This vulnerability class is particularly significant in the PHP ecosystem, where object injection and deserialization vulnerabilities have historically led to severe compromises. The combination of Livewire's automatic property binding with insufficient input validation during hydration creates a code execution path that can be reached without authentication. Laravel's widespread adoption in enterprise applications amplifies the potential impact of this vulnerability.
Impact Analysis
CVE-2025-54068 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker access to all data accessible from the Laravel application context. This includes database contents (via Eloquent models and raw queries), environment variables containing API keys and secrets, session data, user credentials, and any files readable by the web server process.
Integrity (HIGH): Attackers can modify application data, alter database records, inject malicious code into application files, modify Blade templates for persistent compromise, and manipulate business logic. The Laravel framework's extensive capabilities (file system access, queue workers, scheduled tasks) amplify the integrity impact.
Availability (HIGH): Complete disruption of the Laravel application is possible through process termination, database corruption, resource exhaustion, or deployment of destructive payloads. Attackers can also leverage queue workers and scheduled tasks to maintain persistent disruption.
Attack Vector (Network): The vulnerability is exploitable remotely over HTTP/HTTPS by sending crafted Livewire component update requests.
Attack Complexity (Low): While exploitation requires a component to be mounted in a particular way, the attack itself does not require specialized conditions once a suitable component is identified.
Privileges Required (None) / User Interaction (None): The attack is fully unauthenticated and requires no user interaction, enabling automated exploitation at scale.
Exploit Maturity
CVE-2025-54068 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
KEV status: Added to the KEV catalog on 2026-03-20 with a mandatory remediation deadline of 2026-04-03 for federal agencies. All organizations running Laravel Livewire v3 should prioritize immediate remediation.
EPSS score: The EPSS score of 48.851% (97.7th percentile) is exceptionally high, placing this vulnerability in the top 2.3% of all tracked vulnerabilities for exploitation likelihood. This score indicates that nearly half of similarly scored vulnerabilities are actively exploited within 30 days, reflecting the widespread adoption of Laravel Livewire and the availability of exploitation techniques.
Exploitation prerequisites: While the vulnerability requires a Livewire component to be mounted and configured in a particular way, many common Livewire usage patterns meet these criteria. Form components, search interfaces, and data table components with public properties are among the likely vulnerable patterns.
Ransomware association: As of the latest KEV data, no direct ransomware campaign association has been confirmed. However, the unauthenticated RCE capability makes this an attractive initial access vector for ransomware and other threat actors.
Threat landscape: Laravel is one of the most popular PHP frameworks, and Livewire v3 is widely used for building reactive interfaces. The combination of a large install base and straightforward exploitation makes this vulnerability a high-priority target for automated scanning and exploitation campaigns.
Remediation
- Upgrade Livewire immediately. Update to Livewire v3.6.4 or later, which patches the hydration vulnerability. Consult the Livewire security advisory and Laravel security documentation for specific guidance. Use
composer update livewire/livewireto apply the update. - Audit your Livewire components for exposure. Identify all Livewire v3 components in your application, particularly those with public properties that accept user input. Components accessible without authentication are at highest risk. Review component configurations to understand which may be exploitable.
- Implement network-level protections if patching is delayed. Deploy Web Application Firewall (WAF) rules to inspect and filter Livewire update requests (typically POST requests to
/livewire/update). Rate-limit requests to Livewire endpoints and monitor for unusual patterns in component update payloads. - Scan for indicators of compromise. Review application logs for unusual Livewire component update requests, unexpected PHP process executions, or signs of web shell deployment. Check for unauthorized file modifications in the Laravel application directory, particularly in storage, bootstrap/cache, and vendor directories.
- Harden your Laravel deployment. Ensure the web server runs with minimal file system permissions. Disable debug mode in production (
APP_DEBUG=false). Implement Content Security Policy headers. Review and restrict the PHP functions available viadisable_functionsinphp.inito limit post-exploitation capabilities.
Technical Details
CVE-2025-54068 is a CRITICAL unauthenticated remote code execution vulnerability in Laravel Livewire v3's component hydration mechanism.
Technical mechanism: Livewire v3 introduced a new hydration system for synchronizing component state between the client and server. When a user interacts with a Livewire component, the client sends update requests containing serialized component state. The server deserializes (hydrates) this state back into PHP objects and applies property updates. The vulnerability exists in how certain component property updates are processed during hydration. When a Livewire component is mounted and configured in a particular way (with public properties that undergo specific hydration paths), an attacker can craft malicious update payloads that inject code during the deserialization process. This code is then executed on the server with the privileges of the web server process.
Why Livewire v3 only: The vulnerability is unique to Livewire v3 because v3 introduced a fundamentally redesigned hydration system. Livewire v2 used a different approach to state management that does not share this vulnerability. The v3 hydration system provides more features and flexibility but introduced this code injection vector.
CVSS 3.1 vector breakdown (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H):
- Attack Vector (Network): Exploitable remotely via HTTP/HTTPS requests to the Livewire update endpoint.
- Attack Complexity (Low): Once a vulnerable component configuration is identified, exploitation is straightforward. Many common Livewire patterns are vulnerable.
- Privileges Required (None): No authentication is required. The Livewire update endpoint processes requests for components rendered on public pages.
- User Interaction (None): Exploitation is fully automated with no user action required.
- Scope (Unchanged): The vulnerability executes within the PHP process context, though arbitrary code execution effectively grants full server access.
- CIA Impact (all HIGH): Remote code execution provides complete read/write/destroy capabilities on the target system.
Affected versions: Livewire v3.0.0 through v3.6.3. Livewire v2.x is not affected. The fix is included in Livewire v3.6.4.
Frequently Asked Questions
What is CVE-2025-54068?
CVE-2025-54068 is a CRITICAL code injection vulnerability (CVSS 9.8) in Laravel Livewire v3, a popular framework for building reactive web interfaces in Laravel. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the server through the component hydration mechanism. It was added to CISA's KEV catalog on 2026-03-20.
Which versions of Livewire are affected?
Only Livewire v3 (versions 3.0.0 through 3.6.3) is affected. Livewire v2.x uses a different hydration system and is not vulnerable. The fix is available in Livewire v3.6.4. Organizations should update using composer update livewire/livewire.
What is the hydration vulnerability in Livewire v3?
Hydration is the process by which Livewire deserializes client-side component state back into server-side PHP objects. In Livewire v3, this mechanism was redesigned to support more features. The vulnerability exists in how certain property updates are processed during hydration, allowing attackers to inject malicious code through crafted update payloads. The attack requires a component to be mounted with a specific configuration, but many common usage patterns are susceptible.
How do I know if my application is vulnerable?
Your application is vulnerable if it uses Livewire v3 (any version from 3.0.0 to 3.6.3) and has components with public properties accessible from public-facing pages. Check your composer.json or run composer show livewire/livewire to verify your installed version. The safest approach is to upgrade to v3.6.4 regardless, as identifying all potentially vulnerable component configurations manually is difficult.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.