CVE-2024-58136 KEVPublic exploit Critical · 9.8 EPSS 87.8%

Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Summary

The Yii framework (from Yiiframework) before version 2.0.52 contains an improper protection of alternate path flaw in how it attaches behaviors defined by an __class array key. An attacker with network access can exploit this without authentication, user interaction, or special configuration.

Official description · NVD

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

Breakdown

69.8 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Hide code inside another processT1055 · Process InjectionSource dataMedium confidence37 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource dataMedium confidence95 general detection rules

First seen exploited 1 day before it was disclosed.

First seen exploitedVulnCheck KEV evidence9 Apr 20251 day before
Disclosed10 Apr 2025day 0
Added to CISA KEVEU database agrees2 May 2025+22 days

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

A fix was bypassed or incomplete once over 10 months. The latest fix listed for yiisoft/yii2 is 2.0.55.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2024-32877Reflected Cross-site Scripting in yiisoft/yii2 Debug mode30 May 2024
same family
CVE-2024-4990Unsafe Reflection in base Component class in yiisoft/yii220 Mar 2025
regression ofHigh
Why these are linked:
- Stated in the CVE textYii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
- Fixed one release later2.0.49.4 → 2.0.52 (yiisoft/yii2)
- Same code patched: Component.php (machine-matched)Functions: __setcommit 628d406 commit 62d081f commit 40fe496
This CVECVE-2024-58136Yiiframework Yii Improper Protection of Alternate Path10 Apr 2025KEV

Fixes in yiisoft/yii2Packagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2.0.38CVE-2020-1514815 Sep 2020
2.0.49.4CVE-2024-3287730 May 2024
2.0.49.4CVE-2024-499020 Mar 2025
2.0.52CVE-2024-5813610 Apr 2025KEV
2.0.55CVE-2026-3985020 May 2026Latest listed

techniques

2 , grouped by in kill-chain order 2

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

MITRE CTID mapping of the KEV entry · primary impact

The Yii2 PHP framework, prior to version 2.0.52, contains an improper validation flaw that allows an attacker to input arbitrary PHP classes to a JSON file, which will then be instantiated and executed. This can lead to remote code execution and server-side request forgery, among other potential impacts.

Privilege EscalationTA0004

Process Injection T1055 Medium also Stealth

MITRE CTID mapping of the KEV entry · how it is exploited

Detection

0 rules for this CVE · 132 general rules for its techniques

Rules for this CVE

0 that reference CVE-2024-58136 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Process InjectionT105537 general rules

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detectioncriticalstable
Potential Dridex Activitycriticalstable
CobaltStrike Named Pipecriticaltest
CobaltStrike Named Pipe Pattern Regexcriticaltest
HackTool - DInjector PowerShell Cradle Executioncriticaltest
Malicious Named Pipe Createdcriticaltest
RedSun - Named Pipe Createdcriticalexperimental
RedSun - TieringEngineService.exe Detected as EICAR Test Filecriticalexperimental

All 37 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: yiisoft/yii2.

Packagistyiisoft/yii2GHSA-ggwg-cmwp-46r5

Upgrade to 2.0.52 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2020-15148, CVE-2024-4990).

Set the version to 2.0.52 or later in your composer.json.

The first fix for CVE-2024-58136.

Affected versions

If you run	Upgrade to
All versions before 2.0.52	2.0.52

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
44 more on OTX

References

6 links, grouped by NVD tag (1 duplicate merged)

Exploitation evidence

Exploited in the wild

Listed since 2 May 2025. Federal due date 23 May 2025. No recorded ransomware use.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

ENISA

Marked exploited since 2 May 2025. EUVD-2025-10502

Public exploitAdvisories link exploit code.

, 30 Oct 2026

87.8%Top 0.24%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.76%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 570 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9976 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total69.8

Record

Published: 10 Apr 2025
Modified: 17 Jun 2026
: CWE-424 Improper Protection of Alternate Path
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in yiisoft/yii2Packagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

Privilege EscalationTA0004

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

Patch 2

US Government Resource 1

Third Party Advisory 1

Issue Tracking 1

How attackers get in

What they do

techniques