CVE-2026-103475
yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 30, 2026
- Updated
- Sep 30, 2026
- Reserved
- Sep 30, 2026
Description
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-489 Active Debug Code
Affected Products
| Product | Versions |
|---|---|
yii2-starter-kityii2-starter-kit |
|
References
- GitHub Issue #797issue-tracking
- https://github.com/yii-starter-kit/yii2-starter-kitproduct
- https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/common/config/web.php#L21technical-description
- VulnCheck Advisory: yii2-starter-kit through 4.2.0 Debug and Gii Module Exposurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.