CVE-2022-41922

yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input

State: Published
Severity: 8.1 High
Published: Nov 23, 2022
Updated: Apr 23, 2025
Reserved: Sep 30, 2022

Read the record on cve.org

Description

`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
yiiyiisoft	< 1.1.27Affected

References

https://github.com/yiisoft/yii/security/advisories/GHSA-442f-wcwq-fpcf
https://github.com/yiisoft/yii/commit/ed67b7cc57216557c5c595c6650cdd2d3aa41c52

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.