AIKIDO-2026-694446
power-components/livewire-powergrid is vulnerable to Path Traversal
86
High Risk
This Affects:
power-components/livewire-powergridTL;DR
The downloadExport method in the WithExport trait passes a user-controlled filename directly to storage_path() and streams the resulting file. Because it is a public Livewire method, the parameter is reachable through the standard Livewire update endpoint without validation. Supplying directory traversal sequences resolves paths outside the intended storage directory, allowing disclosure of sensitive files such as configuration or environment files. The fix restricts the parameter to an allowlisted plain basename, verifies the resolved real path stays within the storage base directory, and locks the export state properties.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your table component uses the export feature whose downloadExport handler is reachable by externally supplied input via the Livewire update endpoint.
Background info
power-components/livewire-powergrid is vulnerable to Path Traversal in versions 0.0.1 - 6.10.5.
How to fix this
Upgrade the power-components/livewire-powergrid library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant