Livewire Fixes Validation Vulnerability in Laravel

CVE-2024-47823

What is CVE-2024-47823?

The Livewire framework for Laravel contains a vulnerability where file extensions of uploaded files are determined based on their MIME types, without proper validation of the actual file extension. This flaw allows an attacker to exploit the system by uploading a malicious file that appears benign (such as an image) but is actually a PHP file, triggering potential remote code execution. This security issue arises when the filename is derived from the original file name, and if the files are stored in a publicly accessible directory on the server where PHP execution is enabled. The issue has been resolved in versions 2.12.7 and 3.5.2; users are urged to update their systems immediately.

References