Yii2-starter-kit vulnerabilities
We track 2 vulnerabilities in Yii2-starter-kit products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
2vulnerabilities
1critical
1high
0exploited
8.9average CVSS score
Latest Yii2-starter-kit vulnerabilities
- 9.1 Critical severity
yii2-starter-kit: Active Debug Code
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including se
- 8.8 High severity
yii2-starter-kit: Unrestricted Upload of File with Dangerous Type
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them