PatchTheCVEyiiframework vulnerabilities
Recent CVEs affecting yiiframework products. 6 tracked.
yiiframework has 6 tracked vulnerabilities, 2 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 6. Most recent: 2025-06-05. Highest priority: CVE-2024-58136 (score 91/100).
- CVE-2025-48493 MEDIUM 6.5 UPGRADE The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0
- CVE-2025-32027 MEDIUM 6.1 UPGRADE Yii is an open source PHP web framework
- CVE-2025-2690 MEDIUM 6.3 UPGRADE A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39
- CVE-2025-2689 MEDIUM 6.3 UPGRADE A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45
- CVE-2024-58136 CRITICAL 9.0 EXPLOITED UPGRADE Yiiframework Yii Improper Protection of Alternate Path Vulnerability
- CVE-2024-4990 CRITICAL 9.1 DOWNGRADE In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic me
FAQ
How do I fix yiiframework vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is yiiframework being exploited right now?
Yes: 1 yiiframework CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which yiiframework CVE should I patch first?
CVE-2024-58136 currently ranks highest (91/100): Yiiframework Yii Improper Protection of Alternate Path Vulnerability.