PHP package security
Is yiisoft/yii2 vulnerable?
13 known security advisories for yiisoft/yii2. The latest was reported on 2026-05-11 and is fixed in 2.0.55. The newest release, 2.0.55, is not affected by any of them.
2 critical 5 high 5 medium 1 unscored
- Known advisories
- 13
- Newest release
- 2.0.55
- Released
- 2026-05-09
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for yiisoft/yii2
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-05-11 | Yii 2: Local file inclusion via view parameter name collision GHSA-5vpg-rj7q-qpw2 · CVE-2026-39850 · GitHub | high | <2.0.55 | 2.0.55 |
| 2025-04-10 | yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key GHSA-ggwg-cmwp-46r5 · CVE-2024-58136 · GitHub | critical | <2.0.52 | 2.0.52 |
| 2024-06-04 | Unsafe Reflection in base Component class CVE-2024-4990 · GitHub, FriendsOfPHP/security-advisories | high | <2.0.49.4 | 2.0.49.4 |
| 2024-06-02 | Reflected Cross-site Scripting in yiisoft/yii2 Debug mode GHSA-qg5r-95m4-mjgj · CVE-2024-32877 · GitHub | medium | >=2.0.43,<2.0.49.4 | 2.0.49.4 |
| 2022-05-17 | Yii Framework Reflected XSS GHSA-4xh9-5vh8-3p58 · CVE-2017-7271 · GitHub | medium | <2.0.11 | 2.0.11 |
| 2022-05-17 | Yii Cross-site Scripting Framework vulnerability GHSA-4c64-w8fg-xcq2 · CVE-2017-11516 · GitHub | medium | =2.0.12 | not stated |
| 2022-05-14 | Yii Incorrectly Implements CORS GHSA-cr6r-6xm9-ww22 · CVE-2018-20745 · GitHub | medium | <2.0.16 | 2.0.16 |
| 2020-09-14 | Possible remote code execution via unserialize() on user input containing specially crafted string CVE-2020-15148 · GitHub, FriendsOfPHP/security-advisories | high | <2.0.38 | 2.0.38 |
| 2018-03-20 | Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()` CVE-2018-7269 · FriendsOfPHP/security-advisories | unscored | <2.0.12.1 | >=2.0.13,<2.0.13.2 | >=2.0.14,<2.0.15 | 2.0.12.1, 2.0.13.2, 2.0.15 |
| 2018-01-22 | Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode. CVE-2018-6010 · GitHub, FriendsOfPHP/security-advisories | high | <2.0.14 | 2.0.14 |
| 2018-01-13 | The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity CVE-2018-6009 · GitHub, FriendsOfPHP/security-advisories | high | <2.0.14 | 2.0.14 |
| 2015-07-10 | class yii\web\ViewAction allowed to include arbitrary files that end with .php CVE-2015-5467 · GitHub, FriendsOfPHP/security-advisories | critical | <2.0.5 | 2.0.5 |
| 2015-05-10 | JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks CVE-2015-3397 · GitHub, FriendsOfPHP/security-advisories | medium | <2.0.4 | 2.0.4 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about yiisoft/yii2
Does yiisoft/yii2 have known vulnerabilities?
Yes. Packagist lists 13 security advisories for yiisoft/yii2 (2 critical, 5 high, 5 medium severity). The most recent, reported 2026-05-11, is "Yii 2: Local file inclusion via view parameter name collision". The newest release, 2.0.55, is outside every affected range.
Which version of yiisoft/yii2 should I run?
The newest stable release is 2.0.55 (published 2026-05-09). The most recent advisory is fixed in 2.0.55, so stay on or above the fixed version for your major version. Run composer update yiisoft/yii2, then composer audit to confirm nothing else is flagged.
How do I check if my yiisoft/yii2 version is affected?
Run composer show yiisoft/yii2 in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.