p PatchFirst

CVE-2025-32027

CVE-2025-32027 · Yii does not prevent XSS in scenarios where fallback error renderer is used

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.

CVSS 6.1 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • yii

    Versions
    • < 1.1.31: Affected

    No fix published

  • yiisoft/yii Packagist

    Versions
    • 1.1.14
    • 1.1.14-rc
    • 1.1.15
    • 1.1.16
    • 1.1.17
    • 1.1.18
    • 1.1.19
    • 1.1.20
    • 1.1.21
    • 1.1.22
    • 1.1.23
    • 1.1.24
    • 1.1.25
    • 1.1.26
    • 1.1.27
    • 1.1.28
    • 1.1.29
    • 1.1.30
    Affected ranges
    • ECOSYSTEM: < 1.1.31

    Update to 1.1.31

Original sources

Check your server →