GHSA-mw2w-2hj2-fg8q
GitHub Security Advisory
yiisoft/yii deserializing untrusted user input can lead to remote code execution
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
### Impact
Affected versions of `yiisoft/yii` are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input.
### Patches
Upgrade `yiisoft/yii` to version 1.1.29 or higher.
### For more information
See the following links for more details:
- [Git commit](https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06)
- https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
If you have any questions or comments about this advisory, [contact us through security form](https://www.yiiframework.com/security).
Affected Packages
Packagist
yiisoft/yii
Affected versions:
0
(fixed in 1.1.29)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: September 9, 2025 6:37 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.