CVE-2025-32027: Yii Reflected XSS Vulnerability in Fallback Error Renderer
Summary
CVE-2025-32027: Yii does not prevent XSS in scenarios where fallback error renderer is used. Affects yiisoft/yii versions < 1.1.31. Fixed in 1.1.31. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yii is a high-performance PHP framework designed for developing web applications quickly and efficiently. It provides a robust set of features, including MVC architecture, security measures, and extensive libraries. However, certain versions of Yii are susceptible to a reflected cross-site scripting (XSS) vulnerability when the fallback error renderer is employed, potentially exposing applications to security risks.
Vulnerability Detail
The vulnerability arises from the failure of Yii to adequately sanitize user input in scenarios where the fallback error renderer is utilized. This oversight allows attackers to inject malicious scripts into web pages, which can be executed in the context of the user's browser. The ramifications include unauthorized access to sensitive information, session hijacking, and the potential for further exploitation of the application and its users.
How To Fix
Minimum fixed version
1.1.31
This is the first release that contains the fix.
composer require yiisoft/yii:1.1.31Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation and output encoding in your application to mitigate the risk of XSS attacks. However, this is not a substitute for upgrading to the patched version of Yii.
Conclusion
The Yii framework has a reflected XSS vulnerability in specific scenarios involving the fallback error renderer. It is imperative for developers using affected versions to upgrade to version 1.1.31 or higher to protect their applications from potential attacks. Utilizing tools like Vulert can assist in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for yiisoft/yii →
FAQ
The vulnerability is a reflected XSS issue that occurs when the fallback error renderer is used in Yii, allowing attackers to inject malicious scripts.
Affected versions are those prior to 1.1.31. It is crucial to upgrade to 1.1.31 or higher to mitigate this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The consequences include unauthorized access to user data, session hijacking, and the potential for further exploitation of the application.
Yes, implementing input validation and output encoding can help mitigate the risk temporarily, but upgrading to the patched version is essential.
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii.
