{"answers":{"affected":"4 open source packages ship an affected version, including livewire/livewire. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47823 exists.","fix":"Upgrade livewire/livewire to a fixed version for your release line: 2.12.7 or 3.5.2.","what":"CVE-2024-47823 is a high-severity vulnerability in livewire, published on 8 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-47823 and fix it if it is affected.\n\nWhat it is: CVE-2024-47823 is a high-severity vulnerability in livewire, published on 8 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47823 exists.\n\nAffected packages and fixed versions:\n- livewire/livewire (Packagist): affected all versions; fixed in 2.12.7\n- livewire/livewire (Packagist): affected all versions; fixed in 2.12.7\n- livewire/livewire (Packagist): affected from 3.0.0-beta.1; fixed in 3.5.2\n- livewire/livewire (Packagist): affected from 3.0.0-beta.1; fixed in 3.5.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-47823/ (Markdown: https://insights.sbomify.com/CVE-2024-47823/index.md)","id":"CVE-2024-47823","markdown":"https://insights.sbomify.com/CVE-2024-47823/index.md","name":"CVE-2024-47823","record":{"aliases":["GHSA-f3cx-396f-7jqp"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Livewire Laravel framework","requires_auth":"low_privilege","summary":"Attackers can achieve remote code execution by uploading malicious PHP files if the application stores uploads publicly and executes PHP.","user_interaction":"not_required","vuln_class":"file_upload"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"livewire","vendor":"laravel"}],"cvss":{"score":7.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"},{"id":"CWE-20","name":"Improper Input Validation"}],"description":"Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., `image/png`) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack: 1. Filename is composed of the original file name using `$file-\u003egetClientOriginalName()`. 2. Files stored directly on your server in a public storage disk. 3. Webserver is configured to execute “.php” files. This issue has been addressed in release versions `2.12.7` and `3.5.2`. All users are advised to upgrade. There are no known workarounds for this vulnerability.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":"2026-04-10","github_poc":1,"max_poc_stars":8,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-04-10T09:21:26Z","kind":"github_poc","ref":"https://github.com/HelgeSverre/livewire-honeypot","stars":8,"title":"High-interaction honeypot mimicking a vulnerable Laravel/Livewire app. Captures RCE exploits and webshells targeting CVE-2024-47823, CVE-2025-54068, and CVE-2025-14894, then analyzes them in sandboxed Docker containers to extract IOCs."}],"tier":"weaponised"},"has_fix":true,"headline":"Livewire Remote Code Execution (RCE) on File Uploads","id":"CVE-2024-47823","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"file_upload","year":"2024"},"n_packages":4,"n_references":4,"next":{"headline":"Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room","id":"CVE-2024-47824"},"packages":[{"ecosystem":"Packagist","fixed":["2.12.7"],"introduced":["0"],"last_affected":[],"package":"livewire/livewire","purl":null,"source":"GHSA-f3cx-396f-7jqp"},{"ecosystem":"Packagist","fixed":["2.12.7"],"introduced":["0"],"last_affected":[],"package":"livewire/livewire","purl":"pkg:composer/livewire/livewire","source":"GHSA-f3cx-396f-7jqp"},{"ecosystem":"Packagist","fixed":["3.5.2"],"introduced":["3.0.0-beta.1"],"last_affected":[],"package":"livewire/livewire","purl":null,"source":"GHSA-f3cx-396f-7jqp"},{"ecosystem":"Packagist","fixed":["3.5.2"],"introduced":["3.0.0-beta.1"],"last_affected":[],"package":"livewire/livewire","purl":"pkg:composer/livewire/livewire","source":"GHSA-f3cx-396f-7jqp"}],"prev":{"headline":"Directus inserts access token from query string into logs","id":"CVE-2024-47822"},"products":["livewire"],"published":"2024-10-08","related":[{"cvss_score":9.2,"headline":"Laravel Livewire Code Injection","id":"CVE-2025-54068","kev_date_added":"2026-03-20","published":"2025-07-17"},{"cvss_score":8.8,"headline":"Cross-site request forgery in n/a","id":"CVE-2024-22859","kev_date_added":null,"published":"2024-02-01"},{"cvss_score":6.1,"headline":"Cross-site Scripting in livewire/livewire","id":"CVE-2024-21504","kev_date_added":null,"published":"2024-03-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-07-17","vendors":["livewire"]},"summary":"Attackers can achieve remote code execution by uploading malicious PHP files if the application stores uploads publicly and executes PHP.","url":"https://insights.sbomify.com/CVE-2024-47823/"}