CVE-2026-103474

HighCVSS 8.8

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

yii2-starter-kit through 4.2.0 fails to validate file types in backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and execute arbitrary code on the server.

Risk Assessment

A manager-role user can execute malicious code on the server, potentially leading to full compromise of the application and data.

Recommendation

Update yii2-starter-kit to a version newer than 4.2.0 that contains the security fix.

Other vulnerabilities in yii2-starter-kit

CVE-2026-103475Critical
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.

Original NVD description (English source)

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS