Description
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References (3)
Core 3
Core References
Patch x_refsource_confirm
https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8q
Patch x_refsource_misc
https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06
Third Party Advisory x_refsource_misc
https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
Scores
CVSS v3
8.1
EPSS
0.0326
EPSS Percentile
87.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-502
Status
published
Products (2)
yiiframework/yii
< 1.1.29
yiisoft/yii
0 - 1.1.29Packagist
Published
Nov 14, 2023
Tracked Since
Feb 18, 2026