PatchTheCVEyii vulnerabilities and fixes
Recent CVEs affecting yii, with upgrade or downgrade steps. 6 tracked.
yii has 6 tracked vulnerabilities, 2 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 5. Most recent: 2025-04-10. Highest priority: CVE-2024-58136 (score 91/100).
- CVE-2025-32027 MEDIUM 6.1 UPGRADE Yii is an open source PHP web framework
- CVE-2025-2690 MEDIUM 6.3 UPGRADE A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39
- CVE-2025-2689 MEDIUM 6.3 UPGRADE A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45
- CVE-2024-58136 CRITICAL 9.0 EXPLOITED UPGRADE Yiiframework Yii Improper Protection of Alternate Path Vulnerability
- CVE-2024-4990 CRITICAL 9.1 DOWNGRADE In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic me
- CVE-2024-32877 MEDIUM 4.2 DOWNGRADE Yii 2 is a PHP application framework
FAQ
How do I fix yii vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is yii being exploited right now?
Yes: 1 yii CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which yii CVE should I patch first?
CVE-2024-58136 currently ranks highest (91/100): Yiiframework Yii Improper Protection of Alternate Path Vulnerability.