Livewire vulnerable to remote command execution during property update hydration (CVE-2025-54068)

What is affected, what to do

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios.

The vulnerability is being actively exploited; treat it as a priority. Update livewire to version 3.6.4. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Livewire gte 3.0.0-beta.1, < 3.6.4..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade livewire/livewire to version 3.6.4 or later via Composer (composer require livewire/livewire:^3.6.4 then composer update livewire/livewire), followed by php artisan view:clear and php artisan optimize:clear. Only the v3 branch is affected; v2 and earlier are not vulnerable.
   • Inventory every Laravel project: run composer show livewire/livewire on build servers and CI/CD runners; grep composer.lock across repositories for livewire/livewire versions between 3.0.0-beta.1 and 3.6.3. Pay special attention to container images with frozen dependencies.
   • Place internet-facing Laravel apps that use Livewire components behind a WAF or reverse proxy with rate-limiting on the Livewire endpoints (/livewire/update, /livewire/upload-file, /livewire/message/*) until the upgrade is deployed. Vendor explicitly states there are no known workarounds — the patch is the only complete fix.
   • Where immediate upgrade is not possible in production: identify the affected Livewire components (those with dynamic property bindings in mount logic) and, if business-tolerable, temporarily disable their routes or restrict them to authenticated users.
   • Prepare secrets rotation: treat APP_KEY, database credentials, API tokens, mail/S3 credentials from .env as potentially compromised on any host where pre-patch exploitation indicators are found.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Laravel application servers should not have unrestricted outbound internet access. Lock egress policy to the services actually required (DB, cache, payment providers) to make reverse shells and data exfiltration harder.
   • WAF rule: inspect POST requests to /livewire/update and /livewire/message/* with a JSON body; alert or block payloads containing PHP gadget indicators (system, exec, passthru, proc_open, shell_exec, __construct, __destruct, or serialized PHP objects starting with O: inside a property value).
   • Endpoint hardening: extend disable_functions in php.ini (exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec) where the application does not legitimately need them. Scope open_basedir to the application root.
   • IAM/least-privilege: the PHP-FPM/web user (www-data, nginx, apache) must not own the code directory and must only have write access to storage/ and bootstrap/cache/. No sudo, no interactive shell.
   • Configuration: verify APP_DEBUG=false and APP_ENV=production. Debug mode leaks stack traces with path information that materially helps exploit development.
   • CI/CD guardrail: configure your SCA tool (Dependabot, Renovate, Snyk, GitLab Dependency Scanning) to fail builds that resolve livewire/livewire < 3.6.4.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: POST requests to /livewire/update, /livewire/message/*, /livewire/upload-file with unusually large bodies (> 10 KB) or high frequency from a single source IP. KQL shape: WebLogs | where UriPath startswith "/livewire/" and HttpMethod == "POST" | summarize count() by SrcIp, bin(TimeGenerated, 5m) | where count_ > 50.
   • Sysmon EID 1 (Process Create) where ParentImage ends in php-fpm, php, httpd, nginx and Image is /bin/sh, /bin/bash, wget, curl, python, perl, nc. Sigma shape: parent_image|endswith: '/php-fpm' + image|endswith: ['/sh','/bash','/wget','/curl'].
   • Auditd on Laravel hosts: log execve syscalls from the PHP uid where the executed binary is outside /usr/bin/php*. Rule: -a always,exit -F arch=b64 -S execve -F uid=33 -k php_rce.
   • Filesystem monitoring: new PHP files appearing in public/, storage/app/public/, or writes to routes/web.php outside the deployment window. Alert on EDR file-create events with extensions .php, .phtml, .phar outside deployment hours.
   • Network telemetry (Zeek/Suricata): outbound connections from the web-server segment to non-whitelisted destinations, especially on ports 4444, 1337, 8080, 9001 or into TOR/DynDNS ranges. Suricata idea: alert tcp $WEB_SERVERS any -> !$HOME_NET any (msg:"Possible reverse shell from PHP host"; flow:established,to_server; threshold:type limit, track by_src, count 1, seconds 300;).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

Source: NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Laravel Laravel Livewire
• Livewire Livewire

Weakness classes (CWE)

• CWE-94Improper Control of Generation of Code ('Code Injection')

  Base

  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

  Entry at MITRE CWE-94

References & sources

• github.comlivewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3web, x_refsource_CONFIRM, Vendor advisory
• NVD (NIST)vuln/detail/CVE-2025-54068advisory
• github.comlivewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987…web, x_refsource_MISC, Patch
• github.comlivewire/livewirepackage
• github.comlivewire/livewire/releases/tag/v3.6.4web, x_refsource_MISC, Release notes
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068web, government-resource, US government resource
• threathunter.aiblog/iranian-threat-actor-tools-techniques-iocs-ioasweb
• threathunter.aiblog/iranian-threat-actor-tools-techniques-iocs-ioasThird-party advisory, Third-party advisory