CVE-2026-103475CWE-489

CVE-2026-103475

Critical · published September 30, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00397 · 32.7th percentile
Weakness
CWE-489 · Active Debug Code
Published
2026-09-30T22:18Z
References (4)
https://github.com/yii-starter-kit/yii2-starter-kit · [email protected]https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/common/config/web.php#L21 · [email protected]https://github.com/yii-starter-kit/yii2-starter-kit/issues/797 · [email protected]https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-debug-and-gii-module-exposure · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 17:22Z
    yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
    cvelistv5