Known exploited vulnerability
CVE-2024-58136
The short answer
CVE-2024-58136 affects yiiframework Yii and is rated critical (CVSS 9.8). CISA added it to the Known Exploited Vulnerabilities catalog on 2025-05-02: attackers are using it, so patch it first. Fixed versions are published for yiisoft/yii2 (2.0.52).
What it is
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
Weakness: CWE-424.
Severity
9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploited (CISA KEV)
Yes, since May 2, 2025
Federal due date May 23, 2025
EPSS, next 30 days
88%
Higher than 100% of scored CVEs
How it can be exploited
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
What CISA says to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected packages and fixed versions
| Package | Ecosystem | Fixed in | Advisory |
|---|---|---|---|
| yiisoft/yii2 | Packagist | 2.0.52 | GHSA-ggwg-cmwp-46r5 |
Is it in your code? Drop your lockfile into the free vulnerability check, or let vulnerability watch check your repository every day and open the upgrade as a pull request.
Affected products
Yii. NVD's record lists the exact affected versions.
References
- github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b12 Patch
- github.com/yiisoft/yii2/compare/2.0.51...2.0.52 Issue Tracking
- github.com/yiisoft/yii2/pull/20232 Patch
- github.com/yiisoft/yii2/pull/20232#issuecomment-2252459709 Issue Tracking
- www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52 Vendor Advisory
- sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ ExploitThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-58136 US Government Resource
Questions
Is CVE-2024-58136 being exploited?
Yes. CISA added CVE-2024-58136 to its Known Exploited Vulnerabilities catalog on 2025-05-02, with a federal remediation due date of 2025-05-23.
How do I fix CVE-2024-58136?
Upgrade to a fixed version: yiisoft/yii2 (Packagist) 2.0.52. CISA's required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
From NVD, CISA KEV, FIRST EPSS and OSV.dev, checked . Status on NVD: Analyzed. The description is NVD's text, quoted as published.
Related
Latest CVEs this week
Critical and High CVEs from the last 7 days, with KEV and EPSS.
Exploited vulnerabilities by vendor
Every vendor in CISA's KEV catalog, with its count.
Yiiframework exploited vulnerabilities
Everything CISA lists as exploited for Yiiframework.
Vulnerability watch
A briefing and a fix pull request when an advisory hits your dependencies.
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.