CVE-2024-58136

CRITICAL KEV NUCLEI

Yii 2 < 2.0.52 Behavior Attachment - __class Code Execution

Title source: manual
STIX 2.1

Exploitation Summary

CVE-2024-58136 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 2, 2025. A Nuclei detection template is also available.

Description

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

Nuclei Templates (1)

Yii2 PHP Framework < 2.0.52 - Remote Code Execution
CRITICALVERIFIEDby ritikchaddha
Shodan: title:"Yii"
FOFA: title="Yii"

References (7)

Core 7

Scores

CVSS v3 9.0
EPSS 0.7726
EPSS Percentile 99.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2025-05-02
VulnCheck KEV 2025-04-09
ENISA EUVD EUVD-2025-10502
CWE
CWE-424
Status published
Products (2)
yiiframework/yii < 2.0.52
yiisoft/yii2 0 - 2.0.52Packagist
Published Apr 10, 2025
KEV Added May 02, 2025
Tracked Since Feb 18, 2026