CVE-2025-2689: yiisoft Yii2 Deserialization of Untrusted Data Vulnerability
Summary
CVE-2025-2689: yiisoft Yii2 Deserialization of Untrusted Data. Affects yiisoft/yii2-dev versions < 2.0.45. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yii2 is a high-performance PHP framework designed for developing web applications. It provides a rich set of features including MVC architecture, ORM, and security measures. However, versions up to 2.0.45 are susceptible to a critical vulnerability that allows for deserialization of untrusted data, potentially compromising application integrity.
Vulnerability Detail
A critical vulnerability has been identified in the Yii2 framework, specifically in the getIterator function of the SortableIterator.php file. This vulnerability arises from improper handling of untrusted data during the deserialization process. An attacker can exploit this flaw remotely, leading to unauthorized access or manipulation of application data. The potential ramifications include data breaches, application crashes, or unauthorized actions performed on behalf of legitimate users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can implement input validation to sanitize data before deserialization. This can help mitigate the risk until a full update is applied. For example, ensure that any data being deserialized comes from a trusted source and validate its structure before processing.
Conclusion
The Yii2 framework is vulnerable to a critical deserialization issue that can be exploited remotely. It is crucial for developers using affected versions to update their packages promptly to ensure the security of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for yiisoft/yii2-dev →
FAQ
The CVSS score for this vulnerability is 6.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and potential data breaches.
Yes, updating to a version higher than 2.0.45 will patch this vulnerability.
Implement input validation to sanitize any untrusted data before deserialization as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2-dev.
