CVE-2026-103476
MediumCVSS 5.3Summary
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.
Risk Assessment
Unauthorized access to files from unpublished articles can lead to the leakage of confidential information not intended for public disclosure.
Recommendation
Update yii2-starter-kit to a version later than 4.2.0. Implement authorization checks in the attachment-download endpoint to verify article publication status.
Other vulnerabilities in yii2-starter-kit
See all- CVE-2026-103474High
yii2-starter-kit through 4.2.0 fails to validate file types in backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and execute arbitrary code on the server.
- CVE-2026-103475Critical
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
Original NVD description (English source)
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS