CVE-2025-54068: Laravel Livewire RCE Vulnerability

CVE-2025-54068 Overview

CVE-2025-54068 is a critical remote code execution (RCE) vulnerability affecting Livewire, a full-stack framework for Laravel. The flaw exists in Livewire v3 through v3.6.3 and stems from how certain component property updates are hydrated. Unauthenticated attackers can achieve remote command execution when a component is mounted and configured in a specific way. The vulnerability is unique to Livewire v3 and does not affect prior major versions. The Cybersecurity and Infrastructure Security Agency (CISA) has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Livewire v3.6.4 contains the patch.

Critical Impact
Unauthenticated remote code execution against Laravel applications using vulnerable Livewire v3 components, with confirmed in-the-wild exploitation per CISA KEV.

Affected Products

Laravel Livewire v3.0.0 through v3.6.3
Laravel applications embedding vulnerable Livewire components
Composer package laravel/livewire prior to v3.6.4

Discovery Timeline

2025-07-17 - CVE-2025-54068 published to the National Vulnerability Database (NVD)
2026-03-20 - Last updated in the NVD database

Technical Details for CVE-2025-54068

Vulnerability Analysis

The vulnerability is classified as Improper Control of Generation of Code [CWE-94] and enables remote command execution against Laravel applications running Livewire v3. Livewire serializes component state on the server and rehydrates it from client-supplied payloads on each request. When the framework processes property updates during hydration, untrusted input flows into code-generation paths that the server later evaluates. Attackers craft a malicious update payload targeting a mounted component and trigger execution of attacker-controlled code within the PHP process. Exploitation requires no authentication and no user interaction, although the attacker must reach a component configured in a vulnerable way.

Root Cause

The root cause lies in the hydration logic for component property updates. Livewire trusts portions of the serialized state and parameter payload that should be treated as untrusted client input. This trust boundary failure allows attacker-supplied values to be interpreted as executable code rather than data. The fix in commit ef04be759da41b14d2d129e670533180a44987dc tightens validation and removes the unsafe code-generation behavior. See the GitHub Security Advisory GHSA-29cq-5w36-x7w3 for the maintainers' technical description.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends a crafted Livewire update request to an endpoint that renders a vulnerable component. The malicious payload manipulates property values during hydration so that attacker-controlled code runs server-side. Successful exploitation yields code execution with the privileges of the PHP-FPM or web server process, enabling data theft, lateral movement, and webshell deployment.

No verified proof-of-concept code is published in the enriched data. Refer to the GitHub commit reference for the upstream patch diff and impacted code paths.

Detection Methods for CVE-2025-54068

Indicators of Compromise

Unexpected outbound connections from PHP-FPM or web server processes following Livewire update requests
New or modified PHP files in application directories such as storage/, public/, or bootstrap/cache/
HTTP POST requests to the /livewire/update or /livewire/message/* endpoints carrying unusually large or obfuscated serverMemo, updates, or snapshot payloads
Web server logs showing 200 responses to Livewire endpoints followed by spawned shell processes (sh, bash, php -r)

Detection Strategies

Inspect Laravel application logs and request bodies for malformed Livewire hydration payloads referencing class names or property values that resolve to executable code
Alert on PHP processes spawning child processes such as sh, bash, curl, wget, or python immediately after Livewire endpoint activity
Hunt for Livewire request payloads that include serialized PHP objects, base64-encoded blobs, or unexpected __class keys

Monitoring Recommendations

Enable verbose request logging at the reverse proxy and capture full POST bodies sent to Livewire routes for retroactive hunting
Monitor file integrity in web roots and writable Laravel directories to identify dropped webshells
Correlate Livewire endpoint access with process-creation telemetry from EDR tooling to surface post-exploitation behavior

How to Mitigate CVE-2025-54068

Immediate Actions Required

Upgrade Livewire to v3.6.4 or later using composer update livewire/livewire and redeploy affected applications
Audit application source for custom Livewire components that accept untrusted input into mounted properties and review their public method signatures
Review web server, PHP-FPM, and Laravel logs since July 2025 for signs of exploitation, given confirmed CISA KEV listing

Patch Information

The Livewire maintainers released the fix in Livewire v3.6.4. The corresponding upstream change is documented in GitHub commit ef04be7 and the GitHub Security Advisory GHSA-29cq-5w36-x7w3. The advisory states that no workarounds are available, so upgrading is mandatory.

Workarounds

No vendor-supplied workarounds exist; upgrading to v3.6.4 or later is the only supported remediation
As a compensating control, restrict access to Livewire endpoints behind a Web Application Firewall (WAF) rule that blocks anomalous updates and snapshot payloads until the patch is deployed
Where feasible, disable or remove unauthenticated Livewire components from public-facing routes pending the upgrade

bash

# Configuration example
composer require livewire/livewire:^3.6.4
php artisan view:clear
php artisan config:clear