GitHub Advisoryadvisory · Packagist

GHSA-7r2v-8wxr-3ch5 Yii does not prevent XSS in scenarios where fallback error renderer is used

MEDIUM Published 2025-04-11 Modified 2025-04-11 Official page ↗
Aliases
CVE-2025-32027
Ecosystem
Packagist
Packages
yiisoft/yii
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-04-11

Affected packages

• Packagist yiisoft/yii: < 1.1.31 → fixed in 1.1.31

Description

Impact Affected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Patches Upgrade yiisoft/yii to version 1.1.31 or higher. References • Git commit If you have any questions or comments about this advisory, contact us through security form.

Related

Alias · CVE (1)

  • CVE-2025-32027 Yii is an open source PHP web framework. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References