Yii2 Starter Kit EUVD-2026-90206

Exploitable only when a yii2-starter-kit application (through 4.2.0) is deployed with its development configuration active and network-reachable, because that profile sets the debug and Gii modules' allowedIPs to ['*'] (see common/config/web.php line 21). Given that, no authentication or user interaction is required - any remote client can hit the debug endpoint to read session cookies and database queries, and the Gii endpoint to generate and write PHP into the application directory. The primary limiting factor is deployment posture: a correctly hardened production configuration restricts allowedIPs (typically to localhost), so internet exposure requires an operator shipping the dev/staging profile publicly.

The vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) reflects a genuinely dangerous outcome: unauthenticated network attackers reach the Yii debug module (leaking session cookies and executed database queries → VC:H) and the Gii code generator (writing attacker-controlled PHP files into the application directory → VI:H, effectively a path to remote code execution). SSVC-wise the technical impact is high and the flaw is trivially automatable via simple HTTP requests. However, the single most important mitigating signal is buried in the description: this exposure exists in the DEFAULT DEVELOPMENT configuration (allowedIPs set to ['*'] in common/config/web.php), not a hardened production build. Real-world risk therefore hinges entirely on whether an operator deployed the development/staging profile to an internet-reachable host - a real and common misconfiguration, but not the framework's intended production posture. No EPSS score, no CISA KEV listing, and no public exploit code were supplied, so there is no evidence of active exploitation; the 9.3 is a worst-case rating rather than a confirmed widespread-exploitation priority. This is best characterized as a high-impact, low-prevalence issue whose true exposure depends on deployment discipline.

An operator deploys a yii2-starter-kit application (≤4.2.0) to an internet-facing server while retaining the development configuration. An unauthenticated attacker requests the debug endpoint to harvest session cookies and database query contents, then invokes the Gii generator endpoint to write a malicious PHP file into the webroot, which is subsequently executed to achieve code execution. No public proof-of-concept was referenced, but exploitation requires only ordinary HTTP requests (AV:N/AC:L/PR:N).