CVE-2024-58136
Yiiframework Yii Improper Protection of Alternate Path Vulnerability
Description
CVE-2024-58136 is a critical vulnerability in Yii 2, a widely used PHP web application framework, where versions before 2.0.52 mishandle the attaching of behavior defined by an __class array key. This is a regression of the previously patched CVE-2024-4990 and was actively exploited in the wild from February through April 2025. With a CVSS v3.1 base score of 9.0 (Critical), the vulnerability enables remote attackers to manipulate application behavior through crafted input, potentially leading to remote code execution. CISA added CVE-2024-58136 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 23, 2025, and its EPSS score of 67.06% at the 98th percentile confirms intense exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| yiiframework | yii | < 2.0.52 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b12(Patch)
- https://github.com/yiisoft/yii2/compare/2.0.51...2.0.52(Issue Tracking)
- https://github.com/yiisoft/yii2/pull/20232(Patch)
- https://github.com/yiisoft/yii2/pull/20232#issuecomment-2252459709(Issue Tracking)
- https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52(Vendor Advisory)
- https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-58136(US Government Resource)
Weakness Type
CWE-424: Improper Protection of Alternate Path
CVE-2024-58136 is classified under CWE-424, Improper Protection of Alternate Path. This weakness occurs when software does not sufficiently protect all possible paths through which an attacker can reach a sensitive area of functionality. In Yii 2, the initial fix for CVE-2024-4990 did not account for an alternate method of specifying class instantiation through the __class array key, allowing attackers to bypass the patch and exploit the same underlying issue through a different code path.
Learn more: CWE-424 — Improper Protection of Alternate Path
Impact Analysis
CVE-2024-58136 carries a CVSS v3.1 score of 9.0 (Critical) with a network attack vector (AV:N), high complexity (AC:H), no required privileges (PR:N), and no user interaction (UI:N). The changed scope (S:C) indicates the vulnerability can impact resources beyond the vulnerable Yii application. All three impact dimensions are rated high. Confidentiality is completely at risk because exploitation can lead to arbitrary code execution on the web server, exposing application data, database credentials, user information, and server-side secrets. Integrity faces maximum impact as the attacker can modify application logic, inject malicious code, alter database contents, and compromise the application's behavior for all users. Availability is at high risk since the attacker can disrupt the application or the entire server. The vulnerability is especially dangerous because Yii 2 powers numerous web applications, and the regression nature means that organizations that patched CVE-2024-4990 may have considered themselves protected while remaining vulnerable. The confirmed exploitation in attacks against CraftCMS applications from February through April 2025 demonstrates the real-world weaponization of this vulnerability.
Exploit Maturity
CVE-2024-58136 has been actively exploited in the wild from February through April 2025, as confirmed by CISA and documented in a detailed exploitation analysis by SensePost investigating an in-the-wild campaign using RCE in CraftCMS, which chained this Yii framework vulnerability with CraftCMS-specific attack techniques to achieve remote code execution. CISA added CVE-2024-58136 to the Known Exploited Vulnerabilities catalog on May 2, 2025. The EPSS score of 67.06% at the 98th percentile confirms that this vulnerability ranks among the top 2% for exploitation probability. The regression nature of this vulnerability, being an incomplete fix for CVE-2024-4990, is particularly concerning as it demonstrates that the attack vector was already well-understood by threat actors who simply adapted their exploits to use the alternate __class code path.
Remediation
-
Upgrade Yii 2 to version 2.0.52 or later immediately. The fix is available through Composer and documented in the Yii framework upgrade advisory. Review the commit 40fe496 for technical details of the fix.
-
Check if your application framework depends on Yii 2. Applications built on CraftCMS or other Yii-based frameworks inherit this vulnerability. Update both Yii and the parent framework to their latest versions.
-
Conduct a forensic investigation for signs of exploitation, particularly if your Yii-based application was exposed to the internet from February through April 2025. Look for unexpected file modifications, unauthorized user accounts, web shells, suspicious database queries, and indicators of the CraftCMS exploitation campaign.
-
Implement web application firewall rules to detect and block requests that attempt to manipulate class instantiation through
__classarray keys in request parameters and serialized data. -
Review application code for unsafe deserialization patterns and behavior attachment configurations that may be exploitable through user-controlled input. Apply the principle of least privilege to the web server process and implement strict input validation at the application level.
Technical Details
CVE-2024-58136 is an improper protection of alternate path vulnerability (CWE-424) in Yii 2 before version 2.0.52. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H reflects a network-exploitable flaw with high complexity but no authentication requirements and cross-boundary impact. The vulnerability is a regression of CVE-2024-4990, which addressed the unsafe handling of class instantiation through user-controlled class configuration keys in Yii's behavior attachment mechanism. The original fix blocked the class key but did not account for the __class array key, which Yii also supports as an alternative mechanism for specifying the class to instantiate when attaching behaviors. An attacker can supply crafted input containing a __class key that causes Yii to instantiate an arbitrary PHP class with attacker-controlled parameters, leading to object injection and, depending on available gadget chains in the application, remote code execution. The fix in version 2.0.52 (pull request #20232) extends the protection to cover both the class and __class keys, properly validating behavior definitions before instantiation.
Frequently Asked Questions
Is CVE-2024-58136 being actively exploited?
Yes. CVE-2024-58136 was actively exploited in the wild from February through April 2025, particularly in campaigns targeting CraftCMS applications. CISA added it to the KEV catalog on May 2, 2025, and the EPSS score of 67.06% confirms intense exploitation.
What products are affected by CVE-2024-58136?
Yii 2 versions before 2.0.52 are vulnerable. This includes any web application or framework built on Yii 2, notably CraftCMS, which was specifically targeted in exploitation campaigns.
How do I fix CVE-2024-58136?
Upgrade Yii 2 to version 2.0.52 or later. If using CraftCMS or another Yii-based framework, also update the parent framework. Conduct a forensic review of applications that were exposed during the February-April 2025 exploitation window.
How severe is CVE-2024-58136?
CVE-2024-58136 is rated Critical with a CVSS score of 9.0 and a changed scope, meaning exploitation can impact systems beyond the vulnerable Yii application. The 98th percentile EPSS ranking and confirmed in-the-wild exploitation campaigns make this a top-priority vulnerability for all Yii-based applications.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.