Description
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| yiisoft | yii2 | < 2.0.38 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Maskhe/CVE-2020-15148-bypasses ★ 75 · Sep 21, 2020
几条关于CVE-2020-15148（yii2反序列化）的绕过
-
0xkami/cve-2020-15148 ★ 6 · Oct 27, 2020
cve-2020-15148
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Yii 2 < 2.0.38 - Remote Code Execution http/cves/2020/CVE-2020-15148.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | yiisoft/yii2 | < 2.0.38 | 2.0.38 | GHSA-699q-wcff-g9mj |