CVE-2025-48493 Yii 2 Redis may expose AUTH paramters in logs in case of connection failure
An attacker with log access can read Redis credentials exposed in plain text during connection failures in the Yii 2 Redis extension.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48493?
CVE-2025-48493 is a medium-severity vulnerability in yiisoft yii2-redis, published on 5 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.
Weakness: CWE-532
Which versions are affected by CVE-2025-48493?
2 open source packages ship an affected version, including yiisoft/yii2-redis. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yiisoft/yii2-redis Packagist | All versions | 2.0.20 |
yiisoft/yii2-redis Packagist | All versions | 2.0.20 |
Products include Yiiframework Yii2-Redis.
How do I fix CVE-2025-48493?
Upgrade yiisoft/yii2-redis to 2.0.20 or later.
Is CVE-2025-48493 being exploited?
There is no known exploitation of CVE-2025-48493 in the wild and no public exploit code.
Sources
Also known as GHSA-g3p6-82vc-43jh.