{"id":"CVE-2024-58136","aliases":["EUVD-2025-10502","GHSA-ggwg-cmwp-46r5"],"status":"published","title":"yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key","description":"Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.87757,"percentile":0.99763,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":true},"cwes":["CWE-424"],"published":"2025-04-10T00:00:00Z","modified":"2026-10-28T02:30:59Z","kev":{"date_added":"2025-05-02","due_date":"2025-05-23","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-05-02"},{"source":"kev","since":"2025-05-02"}],"exploits":[{"source":"nuclei","id":"CVE-2024-58136","title":"Yii2 PHP Framework \u003c 2.0.52 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-58136.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"yiisoft/yii2","fixed_in":["2.0.52"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"yiisoft/yii2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.52"}]}]},{"source":"osv","ecosystem":"Packagist","package":"yiisoft/yii2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.52"}]}],"versions":["2.0.0","2.0.0-alpha","2.0.0-beta","2.0.0-rc","2.0.1","2.0.10","2.0.11","2.0.11.1","2.0.11.2","2.0.12","2.0.12.1","2.0.12.2","2.0.13","2.0.13.1","2.0.13.2","2.0.13.3","2.0.14","2.0.14.1","2.0.14.2","2.0.15","2.0.15.1","2.0.16","2.0.16.1","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.22","2.0.23","2.0.24","2.0.25","2.0.26","2.0.27","2.0.28","2.0.29","2.0.3","2.0.30","2.0.31","2.0.32","2.0.33","2.0.34","2.0.35","2.0.36","2.0.37","2.0.38","2.0.39","2.0.39.1","2.0.39.2","2.0.39.3","2.0.4","2.0.40","2.0.41","2.0.41.1","2.0.42","2.0.42.1","2.0.43","2.0.44","2.0.45","2.0.46","2.0.47","2.0.48","2.0.48.1","2.0.49","2.0.49.1","2.0.49.2","2.0.49.3","2.0.49.4","2.0.5","2.0.50","2.0.51","2.0.6","2.0.7","2.0.8","2.0.9"]}],"products":[{"vendor":"yiiframework","product":"yii"}],"references":[{"url":"https://github.com/yiisoft/yii2/pull/20232","tags":["Patch","fix","web"]},{"url":"https://github.com/yiisoft/yii2/pull/20232#issuecomment-2252459709","tags":["Issue Tracking","fix","web"]},{"url":"https://github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b12","tags":["Patch","fix","web"]},{"url":"https://github.com/yiisoft/yii2/compare/2.0.51...2.0.52","tags":["Issue Tracking","web"]},{"url":"https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52","tags":["Vendor Advisory","web"]},{"url":"https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/","tags":["technical-description","Exploit","Third Party Advisory","article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-58136","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58136","tags":["advisory"]},{"url":"https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ggwg-cmwp-46r5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58136.json","tags":["advisory"]},{"url":"https://github.com/yiisoft/yii2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-58136","description":"Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.","status":"published","published":"2025-04-10T00:00:00Z","modified":"2025-10-21T22:55:21.228Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-424"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2025-10502","description":"Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.","status":"published","published":"2025-04-10T00:00:00Z","modified":"2025-10-21T22:55:21Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2025-05-02","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-ggwg-cmwp-46r5","title":"yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key","description":"Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.","status":"published","published":"2025-04-10T03:31:32Z","modified":"2025-10-22T19:29:51Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-424"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2024-58136","title":"Yiiframework Yii Improper Protection of Alternate Path Vulnerability","description":"Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.","cwes":["CWE-424"],"kev":{"date_added":"2025-05-02","due_date":"2025-05-23","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2024-58136","description":"Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.","status":"published","published":"2025-04-10T03:15:17.767Z","modified":"2026-06-17T08:14:41.66Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-424"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"CVE-2024-58136","description":"Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.","status":"published","published":"2025-04-10T00:00:00Z","modified":"2026-10-28T02:30:59.941733659Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-424"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"GHSA-ggwg-cmwp-46r5","title":"yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key","description":"Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.","status":"published","published":"2025-04-10T03:31:32Z","modified":"2025-10-22T19:53:03.520505Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-424"],"updated_at":"2026-11-02T15:46:47.822182Z"}]}}