CVE-2026-103474CWE-434unrestricted-file-upload

CVE-2026-103474

High · published September 30, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
31.8
In the wild
Unconfirmed
What it is

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00388 · 31.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-09-30T22:18Z
References (4)
https://github.com/yii-starter-kit/yii2-starter-kit · [email protected]https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/backend/modules/file/controllers/StorageController.php#L36 · [email protected]https://github.com/yii-starter-kit/yii2-starter-kit/issues/797 · [email protected]https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unrestricted-file-upload-rce · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 17:22Z
    yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
    cvelistv5