CVE-2024-58136: yiisoft/yii2 Critical Vulnerability in Behavior Attachment Handling
Summary
CVE-2024-58136: yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a __class Array Key. Affects yiisoft/yii2 versions < 2.0.52. Fixed in 2.0.52. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yii Framework is a high-performance PHP framework designed for developing web applications. It provides a rich set of features, including MVC architecture, security measures, and extensibility through behaviors. However, prior to version 2.0.52, Yii2 mishandled the attachment of behaviors defined by a '__class' array key, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from a regression introduced in CVE-2024-4990, where Yii2 fails to properly handle the attachment of behaviors defined by the '__class' array key. This flaw can be exploited by attackers to execute unauthorized actions, potentially leading to data exposure or manipulation. The vulnerability has been actively exploited in the wild between February and April 2025, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
2.0.52
This is the first release that contains the fix.
composer require yiisoft/yii2:2.0.52Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update immediately, consider reviewing your application's behavior attachment logic to ensure it does not rely on the '__class' array key. Implementing additional validation checks may help mitigate the risk until you can apply the official patch.
Conclusion
The yiisoft/yii2 framework has a critical vulnerability (CVE-2024-58136) that affects behavior attachment handling. It is essential to update to version 2.0.52 or later to mitigate potential risks. Users should also consider reviewing their code for additional security measures.
See every vulnerability recorded for yiisoft/yii2 →
FAQ
CVE-2024-58136 is a critical vulnerability in the Yii2 framework that affects how behaviors are attached, potentially allowing unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 9.0, indicating a critical level of severity.
If an immediate update is not possible, review your behavior attachment logic and implement additional validation checks as a temporary workaround.
You can find more information about Yii Framework vulnerabilities on their official GitHub repository and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2.
