Livewire 3 (Laravel, Filament): attackers can run commands on the server without logging in
Identifiers: CVE-2025-54068 · GHSA-29cq-5w36-x7w3 · CVSS 4.0 9.2 (scored by GitHub)
What it is
A flaw in how Livewire 3 rebuilds a component's state from the browser's request lets an attacker with no account run commands on the server, when a component is mounted and set up in a particular way. Filament 3 and later use Livewire, so Filament admin panels can be affected too. Disclosed in July 2025; CISA added it to its exploited list in March 2026.
On CISA's Known Exploited Vulnerabilities list since March 20, 2026.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| Packagist | livewire/livewire | >= 3.0.0-beta.1, < 3.6.4 | 3.6.4 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up livewire/livewire in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade livewire/livewire to 3.6.4 or later (composer update livewire/livewire; with Filament, update Filament so it can pull it in). The advisory knows no workaround.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.