CVE-2020-15148highCWE-502

CVE-2020-15148: high-severity vulnerability in yiisoft yii2

Unsafe deserialization in Yii 2

Published · Updated

Follow this CVE+ Monitor yii2+ Monitor yiisoft/yii2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.9epss 78%
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
Affected products
yiisoft · yii2
Related CVEs — yiisoft yii2

In the same product, most dangerous first.

CVE-2026-39850HIGHYii 2: Local file inclusion via view parameter name collisionEPSS 0.5%CVE-2024-32877MEDIUMReflected Cross-site Scripting in yiisoft/yii2 Debug modeEPSS 0.3%