CVE-2020-36655

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2023-01-21

Last modified

2025-04-02

Weaknesses

CWE-94

Affected products

• Gii (Yiiframework)

References

• https://github.com/yiisoft/yii2-gii/issues/433
• https://lab.wallarm.com/yii2-gii-remote-code-execution/