{"id":"CVE-2024-58136","kind":"vulnerability","aliases":["CVE-2024-58136"],"related":[],"title":"yiiframework yii: Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990…","description":"Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Yii, a PHP web framework, contains a flaw that lets a remote attacker run arbitrary code on the server. CISA lists it as actively exploited, and the same flaw is said to affect other Yii-based products such as Craft CMS.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-05-02T00:00:00+00:00","products":[{"name":"yiiframework yii","fixed":["2.0.52"],"affected":"< 2.0.52","ecosystem":"vendor"},{"name":"Yiiframework Yii","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["craft-cms","exploited","package","php","yii"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action). Affected and fixed versions are unknown from the sources.","status":"open","published_at":"2025-04-10T03:15:17+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:41+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:48:41Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action). Affected and fixed versions are unknown from the sources.","reach":"internet","summary":"Yii, a PHP web framework, contains a flaw that lets a remote attacker run arbitrary code on the server. CISA lists it as actively exploited, and the same flaw is said to affect other Yii-based products such as Craft CMS.","category":"package","who_cares":["php","yii","craft-cms"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker runs arbitrary code on the server.","analyst_note":"Find the affected and fixed Yii versions and the vendor advisory, and check whether Craft CMS (CVE-2025-32432) has a fixed release; the sources give no version or detection steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000443,"input_tokens":2575,"output_tokens":372,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':137C '-2024':22A,25A,28A '-2025':123C '-32432':124C '-4990':23A '-58136':26A,29A '2':4A '2.0.52':6A '22':136C 'action':127C 'activ':64B 'affect':73B,106C 'allow':95C 'altern':90C 'appli':128C 'applic':134C 'arbitrari':55B,101C 'array':18A 'attach':9A 'attack':53B,98C 'base':77B 'behavior':11A 'bod':135C 'cisa':60B,125C 'class':17A 'cloud':140C 'cms':36B,82B,118C 'code':56B,102C 'contain':46B,85C 'could':105C 'craft':35B,81B,117C 'craft-cm':34B 'cve':21A,24A,27A,122C 'defin':14A 'discontinu':143C 'execut':100C 'exploit':37B,65B 'flaw':48B,69B 'follow':133C 'framework':45B,84C 'guidanc':138C 'implement':110C 'improp':87C 'includ':112C 'instruct':132C 'key':19A 'let':50B 'limit':115C 'list':61B 'may':94C 'mishandl':7A 'mitig':129C,149C 'packag':38B 'path':91C 'per':130C 'php':39B,43B 'product':78B,108C,147C 'protect':88C 'remot':52B,97C 'repres':120C 'requir':126C 'run':54B 'said':71B 'server':59B 'servic':141C 'unavail':151C 'use':144C 'vendor':131C 'vulner':92C,104C 'web':44B 'yii':2A,3A,31A,33A,40B,41B,76B,83C,111C 'yii-bas':75B 'yiiframework':1A,30A,32A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-04-10T03:15:17+00:00","kev":{"dateAdded":"2025-05-02","dueDate":"2025-05-23","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-58136","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-58136","severity":null,"published_at":"2025-05-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-58136","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58136","severity":null,"published_at":"2025-04-10T03:15:17+00:00","modified_at":"2026-06-17T08:14:41+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}