GHSA-ggwg-cmwp-46r5 CVE-2024-58136
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
- Severity
- 9.0 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 87.76%
- Chance of exploitation in the next 30 days. Higher than 99.76% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since May 2, 2025
- Weakness
- CWE-424 Improper Protection of Alternate Path
- Fix
2.0.52- Upgrade yiisoft/yii2 to this version or later
Description
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| yiisoft/yii2 | < 2.0.52 |
2.0.52 |
| yiisoft/yii2 | < 2.0.52 |
2.0.52 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
yiisoft/yii2 Packagist → 2.0.52
- composer
composer require yiisoft/yii2:^2.0.52
Severity breakdown
CVSS 3.1 9.0
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- Exploit maturity
- H
Weakness
CWE-424: Improper Protection of Alternate Path
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
How to prevent it
- Architecture and Design: Deploy different layers of protection to implement security in depth.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes | Not rated yet | Same weakness, CWE-424 |
| EEF-CVE-2026-82754 ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls | Not rated yet | Same weakness, CWE-424 |
| GHSA-25gq-j9jx-43pg Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | Medium | Same weakness, CWE-424 |
| GHSA-263q-5cv3-xq9g Gitea allows attackers to add attachments with forbidden file extensions | Medium | Same weakness, CWE-424 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor