Exploited Yii Patch Bypass Enables Remote Code Execution in CraftCMS
Active Exploitation · 3 sources · Updated 17d ago · First seen May 2, 2025
A critical unsafe reflection vulnerability in Yii 2 versions before 2.0.52, tracked as CVE-2024-58136, bypasses the fix for CVE-2024-4990 and permits arbitrary class instantiation. The earlier patch validates the class configuration key, but Yii’s object-creation logic prioritizes the separate __class key, leaving a path for unsafe behavior attachment. The CVE record assigns a CVSS v3.1 score of 9.0 and reports exploitation in the wild from February through April 2025. Attackers exploited the flaw in CraftCMS in connection with CVE-2025-32432 to achieve remote code execution; CVE-2024-58136 entered the Known Exploited Vulnerabilities catalog on May 2, 2025.
Rapid7 researchers also demonstrated an alternative remote code execution chain against CraftCMS 5.6.16, poisoning an application log at a controlled path and including it through Yii’s PhpManager class. Separately, they demonstrated blind server-side request forgery using Psy\Readline\Hoa\FileRead in a Yii basic-template application, showing impact beyond the observed CraftCMS exploitation chain. Yii 2.0.52 fixes the vulnerability, and maintainers issued an upgrade advisory. Organizations should prioritize updating affected Yii dependencies, verify that deployed CraftCMS installations include the relevant fixes, and investigate potentially exposed systems for evidence of compromise.
