Reflected XSS Vulnerability in Yii PHP Framework by Yii Software
CVE-2025-32027

6.1MEDIUM

Key Information:

Vendor

Yiisoft

Status
Yii
Vendor
CVE Published:
10 April 2025

What is CVE-2025-32027?

The Yii PHP Framework, prior to version 1.1.31, is susceptible to a reflected cross-site scripting (XSS) vulnerability under certain conditions when the fallback error renderer is activated. This issue allows malicious entities to inject scripts into web pages, potentially executing arbitrary code in the context of the user's session. To mitigate this vulnerability, users are strongly advised to upgrade to version 1.1.31 or above.

Affected Version(s)

yii < 1.1.31

References

https://github.com/yiisoft/yii/security/advisories/GHSA-7...
x_refsource_CONFIRM
https://github.com/yiisoft/yii/commit/d386d737861c9014269...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.