Description
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
Exploits (2)
Nuclei Templates (1)
Yii 2 < 2.0.38 - Remote Code Execution
CRITICALby pikpikcu
References (2)
Core 2
Core References
Mitigation, Third Party Advisory x_refsource_confirm
https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj
Patch, Third Party Advisory x_refsource_misc
https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99
Scores
CVSS v3
8.9
EPSS
0.9343
EPSS Percentile
99.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
Details
CWE
CWE-502
Status
published
Products (2)
yiiframework/yii
< 2.0.38
yiisoft/yii2
0 - 2.0.38Packagist
Published
Sep 15, 2020
Tracked Since
Feb 18, 2026