CVE-2026-103475
CriticalCVSS 9.1Summary
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
Risk Assessment
The risk includes disclosure of sensitive data such as session cookies and database queries, and the possibility of remote code execution by writing PHP files, which may lead to full application compromise.
Recommendation
It is recommended to modify the development configuration of yii2-starter-kit to restrict access to debug and Gii modules to trusted IP addresses only, and consider upgrading to a newer version if available.
Other vulnerabilities in yii2-starter-kit
Original NVD description (English source)
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS