CVE-2025-54068: Remote Code Execution in Livewire v3

CVE-2025-54068 describes a remote code execution (RCE) vulnerability in Livewire v3, a full-stack framework for Laravel. The flaw affects versions from v3.0 up to v3.6.3. Exploitation requires neither authentication nor user interaction, making the risk critical for Laravel applications using this framework. The vulnerability lies in how certain component properties are hydrated during request processing, and requires a component to be mounted and configured in a particular way.

The reported CVSS score is 9.8, classified as critical by NVD. A patch was released on July 17, 2025, in version 3.6.4. According to security alerts published today, there is evidence of active real-world exploitation and publicly available exploits. No known workarounds have been identified. This combination of criticality, absence of alternative mitigations, and confirmed exploitation distribution makes immediate patching an absolute priority.

Recommended actions for IT teams and system administrators: 1) Immediately verify which Laravel applications use Livewire; 2) Check the versions currently in use; 3) Update all instances to Livewire v3.6.4 or later as soon as possible; 4) Examine access logs for exploitation signs (anomalous requests to Livewire components); 5) Test the update in staging before production deployment.