Yii CVE-2024-58136
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
AnalysisAI
Yii Framework 2 before 2.0.52 contains a behavior attachment regression that allows attackers to exploit the __class array key for arbitrary class instantiation, exploited in the wild February-April 2025.
Technical ContextAI
The CWE-424 insufficient protection flaw allows attackers to specify arbitrary PHP classes via the __class key when attaching behaviors to Yii components. This enables instantiation of dangerous classes that provide code execution.
RemediationAI
Update Yii 2 to 2.0.52+. Review application code for dynamic behavior attachment patterns. Monitor for exploitation attempts.
Share
External POC / Exploit Code
Leaving vuln.today