Yiisoft vulnerabilities
We track 8 vulnerabilities in Yiisoft products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on May 20, 2026.
Latest Yiisoft vulnerabilities
- 7.4 High severity
Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the…
Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement
- 9.8 Critical severity
Yii2: Deserialization of Untrusted Data
A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the
- 9.8 Critical severity
Yii2: Deserialization of Untrusted Data
A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack m
- 9.1 Critical severity
yiisoft/yii2: Use of Externally-Controlled Input to Select Classes or Code
In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes
- 8.8 High severity
yii2-authclient: Improper Authentication
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be
- 9.8 Critical severity
yii2-authclient: Observable Discrepancy
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is
- 9.8 Critical severity
yii: Deserialization of Untrusted Data
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system
- 9.8 Critical severity
yii: Deserialization of Untrusted Data
`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.