livewire vulnerabilities and fixes

Recent CVEs affecting livewire, with upgrade or downgrade steps. 2 tracked.

livewire has 2 tracked vulnerabilities, 2 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 2. Most recent: 2025-07-17. Highest priority: CVE-2025-54068 (score 94/100).

• CVE-2025-54068 CRITICAL 9.8 EXPLOITED UPGRADE Laravel Livewire Code Injection Vulnerability
• CVE-2024-47823 CRITICAL 9.8 UPGRADE Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP

FAQ

How do I fix livewire vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is livewire being exploited right now?

Yes: 1 livewire CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which livewire CVE should I patch first?

CVE-2025-54068 currently ranks highest (94/100): Laravel Livewire Code Injection Vulnerability.

← Back to latest CVEs