CVE-2024-58136 Yiiframework Yii Improper Protection of Alternate Path
Attackers can execute arbitrary code by exploiting improper handling of behavior attachment via class array keys in the Yii framework.
- Exploited in the wild
- Since 2 May 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-58136?
CVE-2024-58136 is a critical code injection vulnerability in yiiframework Yii, published on 10 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
Weakness: CWE-424
Which versions are affected by CVE-2024-58136?
2 open source packages ship an affected version, including yiisoft/yii2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yiisoft/yii2 Packagist | All versions | 2.0.52 |
yiisoft/yii2 Packagist | All versions | 2.0.52 |
Products include Yiiframework Yii.
How do I fix CVE-2024-58136?
Upgrade yiisoft/yii2 to 2.0.52 or later. US federal agencies must fix it by 23 May 2025.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-58136 being exploited?
Yes. Attackers have exploited CVE-2024-58136 in the wild since at least 2 May 2025.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in yiiframework Yii
Sources
Also known as GHSA-ggwg-cmwp-46r5.