Critical severity · published Apr 10, 2025
CVE-2024-58136
Yiiframework Yii Improper Protection of Alternate Path Vulnerability
In wildKEV
9.8
CVSS
87.8%
EPSS
Yes
On KEV
Description
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)87.8% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 2, 2025
Federal remediation dueMay 23, 2025
Ransomware campaign useNot known
Affected products
Which versions
YI
Yii · yiiframework
2 before 2.0.52 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-58136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-58136
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
github.com
https://github.com/yiisoft/yii2/pull/20232
github.com
https://github.com/yiisoft/yii2/pull/20232#issuecomment-2252459709
github.com
https://github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b12
github.com
https://github.com/yiisoft/yii2/compare/2.0.51...2.0.52
www.yiiframework.com
https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52
More from Yii
10.0
CVE-2020-15148
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input
9.8
CVE-2025-2690
yiisoft Yii2 MockClass.php generate deserialization
9.8
CVE-2025-2689
yiisoft Yii2 SortableIterator.php getIterator deserialization
9.8
CVE-2023-47130
Unsafe deserialization of user data in yiisoft/yii
9.8
CVE-2015-5467
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter