CVE-2025-32027
Yii does not prevent XSS in scenarios where fallback error renderer is used
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Yii does not prevent XSS in scenarios where fallback error renderer is used
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.
Reserved 2025-04-01 | Published 2025-04-10 | Updated 2025-04-10 | Assigner GitHub_MCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
github.com/...ft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5
github.com/...ommit/d386d737861c9014269b7ed8c36c65eadb387368
Support options
