Yii does not prevent XSS in scenarios where fallback error renderer is used

보통 6.1CVE-2025-32027 · GHSA-7r2v-8wxr-3ch5 · Published 10/04/2025 · updated 17/06/2026

요약

CVE-2025-32027은(는) yiisoft/yii, yii (yiiframework)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.24%, 전체 취약점의 15.7%보다 높음.
조치: 1.1.31 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
yiisoft/yii Packagist	`< 1.1.31`	`1.1.31`
yii yiiframework	`< 1.1.31`	`1.1.31`

Description

Impact

Affected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used.

Patches

Upgrade yiisoft/yii to version 1.1.31 or higher.

References

Git commit

If you have any questions or comments about this advisory, contact us through security form.

NVD description

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.

References

yiisoft/yii security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-32027 · ADVISORY
yiisoft/yii commit d386d73 · WEB
yiisoft/yii · PACKAGE

yiisoft/yii의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

yiisoft/yii

Packagist

< 1.1.31

1.1.31

yii

yiiframework

< 1.1.31

1.1.31

Description

Impact

Affected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used.

Patches

Upgrade yiisoft/yii to version 1.1.31 or higher.

References

Git commit

If you have any questions or comments about this advisory, contact us through security form.

NVD description

yiisoft/yii의 다른 취약점

모두 보기 →