SB2025042836 - Remote code execution in Yii framework

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025042836

SB2025042836 - Remote code execution in Yii framework

Published: April 28, 2025

Security Bulletin ID SB2025042836
CSH Severity
Critical
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper protection of alternate path (CVE-ID: CVE-2024-58136)

CWE-ID: CWE-424 - Improper Protection of Alternate Path

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper protection of alternate path in framework/base/Component.php. A remote non-authenticated attacker can send a specially crafted request to the application and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild since February 2025.


Remediation

Install update from vendor's website.

References