Yii2 Starter Kit CVE-2026-103474

Requires an authenticated account with the backend 'manager' role in yii2-starter-kit (through 4.2.0); the attacker abuses the backend file-storage module's upload action (StorageController), which fails to validate file type/extension, to write a .php file into the web-accessible storage directory and then requests that URL to trigger execution. Limiting factors: exploitation is gated on manager-level authentication (PR:L, not unauthenticated), on the backend file-storage module being enabled and reachable, and on the storage directory being served without script-execution restrictions - the default starter-kit layout. No user interaction is required once manager access is held.

This is a genuine, high-consequence flaw for anyone running yii2-starter-kit as a live application, but its real-world priority is tempered by both the authentication requirement and the niche footprint of the affected product. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.7) accurately captures an unrestricted-file-upload-to-RCE: network-reachable, low complexity, no user interaction, full confidentiality/integrity/availability loss. The one real gate is PR:L - the attacker must already hold an authenticated 'manager' role in the backend, so this is not a drive-by remote takeover but a post-authentication privilege-to-RCE escalation. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied data, so per the precision rules this is 'no public exploit identified at time of analysis.' That said, the advisory references the exact vulnerable source line (StorageController.php#L36), and the technique (upload .php, request it) is trivial and well-understood, so exploit development would be easy for anyone with manager access. Net: a real priority to patch where the product is actually deployed with the backend file module exposed, but not a mass-exploitation candidate given the manager-role prerequisite and the product's limited deployment base. No signals conflict - the CVSS network vector is consistent with the description (HTTP upload then HTTP request of the planted file).

An attacker who has obtained (or been granted) a backend 'manager' account logs into the yii2-starter-kit admin and uses the file-storage upload action to upload a PHP webshell instead of an image, since the upload handler does not validate file type or extension. Because the uploaded file lands in the web-accessible storage directory, the attacker then browses directly to its URL, causing the server to execute the PHP and yielding arbitrary remote code execution under the web server's privileges. No public PoC is referenced, but the vendor advisory pinpoints the exact vulnerable controller line, making weaponization trivial.