CVE-2020-15148
Unsafe deserialization in Yii 2
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unsafe deserialization in Yii 2
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
- Record
CVE-2020-15148- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2020-0813
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
- Record
EUVD-2020-0813- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-699q-wcff-g9mj
Unsafe deserialization in Yii 2
Impact
Remote code execution in case application calls unserialize() on user input containing specially crafted string.
Patches
2.0.38
Workarounds
Add the following to BatchQueryResult.php:
public function __sleep()
{
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
}
public function __wakeup()
{
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
}
For more information
If you have any questions or comments about this advisory, contact us through security form.
- Record
GHSA-699q-wcff-g9mj- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
- Record
CVE-2020-15148- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
- Record
CVE-2020-15148- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-699q-wcff-g9mj
Unsafe deserialization in Yii 2
Impact
Remote code execution in case application calls unserialize() on user input containing specially crafted string.
Patches
2.0.38
Workarounds
Add the following to BatchQueryResult.php:
public function __sleep()
{
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
}
public function __wakeup()
{
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
}
For more information
If you have any questions or comments about this advisory, contact us through security form.
- Record
GHSA-699q-wcff-g9mj- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yiisoft/yii2Packagist |
before 2.0.38 | 2.0.38 |
yiisoft/yii2Packagist |
before 2.0.38, plus listed versions 2.0.02.0.0-alpha2.0.0-beta2.0.0-rc2.0.1 Show 45 moreShow less2.0.102.0.112.0.11.12.0.11.22.0.122.0.12.12.0.12.22.0.132.0.13.12.0.13.22.0.13.32.0.142.0.14.12.0.14.22.0.152.0.15.12.0.162.0.16.12.0.172.0.182.0.192.0.22.0.202.0.212.0.222.0.232.0.242.0.252.0.262.0.272.0.282.0.292.0.32.0.302.0.312.0.322.0.332.0.342.0.352.0.362.0.372.0.42.0.52.0.62.0.7 |
2.0.38 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Yii 2 < 2.0.38 - Remote Code Execution | |
| PoC in GitHub | 0xkami/cve-2020-15148 | 2020-10-27 |
| PoC in GitHub | Maskhe/CVE-2020-15148-bypasses | 2020-09-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15148 is a high vulnerability (CVSS 8.9) in Yiiframework Yii, published September 15, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 77.5%, the 99th percentile. Fixed in yiisoft/yii2 2.0.38.
References
github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj
nvd.nist.gov/vuln/detail/CVE-2020-15148
yiiframework.com/news/303/yii-2-0-38
Left out here: 2 versions. The JSON record has them.