Log in Start free

Vulnerability · Published Mar 24, 2025 · Assigned by VulDB

CVE-2025-2689yiisoft Yii2 SortableIterator.php getIterator deserialization

Medium 6.3

In plain English

A medium-severity unsafe deserialization in Yii2 from yiisoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.6%top 49.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistyiisoft/yii2-devno fix listedGHSA-88m2-j94x-v4fx

Affected products (as reported)

VendorProductVersions
yiisoft Yii2 2.0.02.0.12.0.22.0.32.0.42.0.52.0.62.0.7

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References