Impact In Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.
Patches This issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.
Workarounds There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.
Impact In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.
Patches This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible.
Workarounds There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.
Resources No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.
In livewire/livewire prior to v2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., image/png) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack:
- Filename is composed of the original file name using $file->getClientOriginalName() - Files stored directly on your server in a public storage disk - Webserver is configured to execute “.php” files
PoC In the following scenario, an attacker could upload a file called shell.php with an image/png MIME type and execute it on the remote server. php class SomeComponent extends Component { use WithFileUploads;
#[Validate('image|extensions:png')] public $file;
public function save() { $this->validate();
$this->file->storeAs( path: 'images', name: $this->file->getClientOriginalName(), options: ['disk' => 'public'], ); } }