Package Instance

Information disclosure
Remote attackers can obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.

yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

Deserialization of Untrusted Data
Yii 2 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input.

Cross-site Scripting
Cross-site scripting (XSS) vulnerability in Yii Framework allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6

Cross-site Scripting
A reflected Cross-site scripting exists in yii2.

Unsafe Reflection in base Component class in yiisoft/yii2
Yii2 supports attaching Behaviors to Components by setting properties having the format `'as <behaviour-name>'`.

Internally this is done using the `__set()` magic method. If the value passed to this method is not an instance of the `Behavior` class, a new object is instantiated using `Yii::createObject($value)`. However, there is no validation check that verifies that `$value` is a valid `Behavior` class name or configuration. An attacker that can control the content of the $value variable can then instantiate arbitrary classes, passing parameters to their constructors and then invoking setter methods.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Class `yii\web\ViewAction` allowed to include arbitrary files that end with `.php`.

Origin Validation Error
Yii actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

CSRF vulnerability in switchIdentiy
The `switchIdentity()` function in `web/User.php` did not regenerate the CSRF token upon a change of identity.