AIKIDO-2026-694446
power-components/livewire-powergrid is vulnerable to Path Traversal
86
CVE Score
High
Path Traversal
TL;DR
The downloadExport method in the WithExport trait passes a user-controlled filename directly to storage_path() and streams the resulting file. Because it is a public Livewire method, the parameter is reachable through the standard Livewire update endpoint without validation. Supplying directory traversal sequences resolves paths outside the intended storage directory, allowing disclosure of sensitive files such as configuration or environment files. The fix restricts the parameter to an allowlisted plain basename, verifies the resolved real path stays within the storage base directory, and locks the export state properties.
How do I fix this?
Upgrade the power-components/livewire-powergrid library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your table component uses the export feature whose downloadExport handler is reachable by externally supplied input via the Livewire update endpoint.
Versions
0.0.1 - 6.10.5
Fixed in 6.10.6Background info
power-components/livewire-powergrid is vulnerable to Path Traversal in versions 0.0.1 - 6.10.5.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.