Yiiframework Yii Improper Protection of Alternate Path Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 02/05/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| yiisoft/yii2 | < 2.0.52 | 2.0.52 |
| yii | < 2.0.52 | 2.0.52 |
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free