Is yiisoft/yii2 2.0 vulnerable?

Composer · 56 releases from 2.0.0 to 2.0.55 · latest yiisoft/yii2 is 2.0.55 · checked 2 Nov 2026

No known advisories in the last release

yiisoft/yii2 2.0.55, the last 2.0 release, has no known advisories. 12 advisories affect earlier 2.0.x releases, so update to 2.0.55.

Update within 2.0:composer require yiisoft/yii2:^2.0.55

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 2.0.x, affecting earlier releases

  • HighCVE-2026-39850GHSA-5vpg-rj7q-qpw211 May 2026

    Yii 2: Local file inclusion via view parameter name collision

    Affected
    <2.0.55
    Fixed in
    2.0.55
  • CriticalCVE-2024-58136GHSA-ggwg-cmwp-46r510 Apr 2025

    yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

    Affected
    <2.0.52
    Fixed in
    2.0.52
  • HighCVE-2024-4990GHSA-cjcc-p67m-7qxm2 Jun 2024

    Unsafe Reflection in base Component class in yiisoft/yii2

    Affected
    <2.0.49.4
    Fixed in
    2.0.49.4
  • MediumCVE-2024-32877GHSA-qg5r-95m4-mjgj2 Jun 2024

    Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

    Affected
    >=2.0.43 <2.0.49.4
    Fixed in
    2.0.49.4
  • CriticalCVE-2015-5467GHSA-7cfq-72w2-24q421 Sept 2023

    Yii2 allows attackers to execute any local .php file via a relative path in the view parameter

    Affected
    >=2.0.0 <2.0.5
    Fixed in
    2.0.5
  • MediumCVE-2015-3397GHSA-w2xx-jp9f-gp8g17 May 2022

    Yii Framework Cross-site Scripting Vulnerability

    Affected
    <2.0.4
    Fixed in
    2.0.4
  • MediumCVE-2017-7271GHSA-4xh9-5vh8-3p5817 May 2022

    Yii Framework Reflected XSS

    Affected
    <2.0.11
    Fixed in
    2.0.11
  • MediumCVE-2017-11516GHSA-4c64-w8fg-xcq217 May 2022

    Yii Cross-site Scripting Framework vulnerability

    Affected
    >=2.0.12 <2.0.13
    Fixed in
    2.0.13
  • HighCVE-2018-6009GHSA-cwhm-272p-3wj914 May 2022

    Yii Framework Cross-Site Request Forgery (CSRF)

    Affected
    >=2.0 <2.0.14
    Fixed in
    2.0.14
  • MediumCVE-2018-20745GHSA-cr6r-6xm9-ww2214 May 2022

    Yii Incorrectly Implements CORS

    Affected
    <2.0.16
    Fixed in
    2.0.16
  • HighCVE-2018-6010GHSA-8gfq-c54m-3rf613 May 2022

    Yii Framework reflected Cross-site Scripting

    Affected
    >=2.0.0 <2.0.14
    Fixed in
    2.0.14
  • HighCVE-2020-15148GHSA-699q-wcff-g9mj15 Sept 2020

    Unsafe deserialization in Yii 2

    Affected
    <2.0.38
    Fixed in
    2.0.38

Which of your client projects are still on yiisoft/yii2 2.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact yiisoft/yii2 version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.