MediumGHSA-88m2-j94x-v4fxCVE-2025-2689

yiisoft Yii2 Deserialization of Untrusted Data

Published 24 Mar 2025 · Updated 24 Mar 2025

Affected package

Affected: <=2.0.45
Fixed in: No fix released

Details

A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Is GHSA-88m2-j94x-v4fx in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected yiisoft/yii2-dev, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2025-2689
Linkgithub.com/gaorenyusi/gaorenyusi/blob/main/Yii2.md
Packagegithub.com/yiisoft/yii2
Linkvuldb.com/?ctiid.300710
Linkvuldb.com/?id.300710
Linkvuldb.com/?submit.521709

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.