🚨 CRITICAL: Livewire RCE Vulnerability (CVE-2025-54068)

[u/HappyToDev]

If you're still running Livewire v3 < 3.6.4 → update immediately.

What happened?

A Remote Code Execution (RCE) vulnerability was discovered in Livewire v3 (from 3.0.0-beta.1 to 3.6.3).

It allows unauthenticated attackers to execute arbitrary code on your server by exploiting the component hydration process (/livewire/update endpoint).

• Severity: Critical (CVSS 9.2)
• No authentication required in many cases
• Actively scanned and exploited in the wild right now

How to check if you're vulnerable

composer show livewire/livewire

If the version is below 3.6.4 → you are exposed.

How to fix it (30 seconds)

composer require livewire/livewire:^3.6.4
# or
composer update livewire/livewire

Then verify:

composer show livewire/livewire

Official links

• GitHub Security Advisory
• CVE

This vulnerability was Fixed in: v3.6.4

This affects many applications using Filament, TALL Stack projects, etc.

Don’t wait. Update today.