CVE-2024-58136
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5Description
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
Analysis
Yii Framework 2 before 2.0.52 contains a behavior attachment regression that allows attackers to exploit the __class array key for arbitrary class instantiation, exploited in the wild February-April 2025.
Technical Context
The CWE-424 insufficient protection flaw allows attackers to specify arbitrary PHP classes via the __class key when attaching behaviors to Yii components. This enables instantiation of dangerous classes that provide code execution.
Affected Products
['Yii 2 Framework before 2.0.52']
Remediation
Update Yii 2 to 2.0.52+. Review application code for dynamic behavior attachment patterns. Monitor for exploitation attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today