Yii2 Framework Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2024-58136)
Executive & SecOps Summary
SECOPS ASSESSMENTYii 2 framework versions prior to 2.0.52
Remote attackers can execute arbitrary PHP code on the server and fully compromise the system via specially crafted requests.
Immediately upgrade the Yii2 framework to the patched version 2.0.52 or higher.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Immediately upgrade the Yii2 framework dependency in your PHP project to version 2.0.52 or higher using Composer.
# Update the yiisoft/yii2 constraint in composer.json and update
composer require 'yiisoft/yii2:>=2.0.52' --update-with-dependencies
# Alternatively, run a direct update for the package
composer update yiisoft/yii2 --with-dependencies2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, configure your Web Application Firewall (WAF) or reverse proxy to block incoming requests containing the '__class' key in the request body.
# Temporary Nginx configuration snippet to block requests containing '__class'
# Note: This is a temporary mitigation and does not replace the official patch.
location / {
if ($request_body ~* '__class') {
return 403 'Forbidden: Malicious payload detected';
}
try_files $uri $uri/ /index.php?$args;
}3. Log Audit & IoC Verification Commands
Use the following commands to verify your current Yii2 version and scan web server logs for potential exploitation attempts.
# 1. Check the installed Yii2 version
php yii --version
# Or via composer
composer show yiisoft/yii2 | grep -i 'version'
# 2. Scan access logs for suspicious '__class' patterns
grep -rn '__class' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/nullScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-58136) is a critical Remote Code Execution (RCE) flaw in the Yii 2 framework, arising from how the framework dynamically binds behaviors to components. It is a regression of the previous CVE-2024-4990 fix. Yii2 allows defining behaviors of components using configuration arrays. When user-controlled input is processed, the framework mishandles the attaching of behaviors defined by an '__class' array key, failing to properly restrict or validate the class instantiation.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by targeting application endpoints that accept and process user input into configuration arrays (e.g., deserialization, dynamic form binding, or API request parsing). By injecting an array containing the '__class' key, the attacker can force the application to instantiate arbitrary PHP classes and execute unintended methods. This vulnerability has been actively exploited in the wild between February and April 2025, notably impacting downstream applications built on top of Yii2, such as CraftCMS.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat. An unauthenticated remote attacker can execute arbitrary commands with the privileges of the web server process. This can lead to complete system takeover, database credential theft, source code exfiltration, and lateral movement within the internal network.
Official Vendor Advisories & References
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
Frequently Asked SecOps Questions (CVE-2024-58136)
FAQQ1. How critical is CVE-2024-58136 and is it actively exploited in the wild?
CVE-2024-58136 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 87.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-58136?
Primary impacted vendors include yiisoft across yii2. Scope summary: All Yii 2 framework versions prior to 2.0.52 (2.0.0 to 2.0.51)
Q3. What temporary mitigations or workarounds exist for CVE-2024-58136 before patching?
[Mitigation] Immediately upgrade the Yii2 framework to the patched version 2.0.52 or higher. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-58136
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (yiisoft)
View Category →GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
JFrog Artifactory Authentication Bypass and Administrative Privilege Escalation (CVE-2026-82329)
[Affected Scope] JFrog Artifactory Self-Managed instances running under default configurations
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.