CVE-2024-4990 Unsafe Reflection in base Component class in yiisoft/yii2

What is CVE-2024-4990?

CVE-2024-4990 is a high-severity code injection vulnerability in yiisoft/yii2, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.

Weakness: CWE-470

Which versions are affected by CVE-2024-4990?

2 open source packages ship an affected version, including yiisoft/yii2. It affects 1 product.

Products include Yiiframework Yii.

How do I fix CVE-2024-4990?

Upgrade yiisoft/yii2 to 2.0.49.4 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-4990 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-4990 exists.

Other vulnerabilities in yiisoft/yii2

• CVE-2024-58136 Yiiframework Yii Improper Protection of Alternate Path Exploited Critical 9.0
• CVE-2015-5467 Yii2 allows attackers to execute any local .php file via a relative path in the view parameter Critical 9.8
• CVE-2023-26750 SQL injection in n/a Critical 9.8
• CVE-2018-7269 Yii SQL injection vulnerability Critical 9.8
• CVE-2018-8073 yii2-redis Potential Remote code execution Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cjcc-p67m-7qxm.