Skip to content

KEV: Laravel Livewire code injection (CVE-2025-54068)

Signal: Added to CISA KEV on 2026-03-20 (due 2026-04-03). Livewire is exploitable in the wild.

What it is

Laravel Livewire contains a code injection issue that can enable unauthenticated remote command execution in specific scenarios.

References: - Advisory: https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 - Fix commit: https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-54068

Triage (15 minutes)

  1. Identify all Laravel apps using Livewire and their deployed versions (composer.lock).
  2. Determine exposure: any internet-facing endpoints using Livewire components.
  3. Identify blast radius:
  4. Env secrets (APP_KEY, DB creds, cloud keys)
  5. Filesystem write access (uploads, cache)

Mitigation

  • Upgrade Livewire to the fixed version(s) in the advisory.
  • If you cannot upgrade immediately:
  • Reduce exposure (temporary maintenance window / allowlist).
  • Ensure APP_DEBUG=false and error pages do not leak details.
  • Harden runtime permissions (least-privilege user, restrict writable paths).

Hunt / detection

  • Application logs:
  • Unexpected exceptions tied to Livewire request handling
  • Suspicious inputs to Livewire endpoints (large/encoded payloads)
  • Infrastructure:
  • New processes spawned by php-fpm/queue workers
  • Unusual outbound connections from web/worker nodes

Recovery notes

If exploitation is suspected: - Rotate secrets reachable by the app (DB, queue, caches, cloud tokens). - Rebuild and redeploy from known-good images/artifacts.