CVE-2025-32027

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - security-advisories@github.com

Published

2025-04-10

Last modified

2025-04-10

Weaknesses

CWE-79, CWE-80

Affected products

• Yii (Yiiframework)
• Yii (Yiisoft)

References

• https://github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368
• https://github.com/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5