CVE-2020-15148: Yii 2 unserialize() of untrusted input enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 10.0 with network reachability, no authentication or interaction, and very high EPSS make this a top remediation priority despite no KEV listing.

What it is

Yii 2 before 2.0.38 is vulnerable to remote code execution when an application calls unserialize() on arbitrary user input, a classic CWE-502 deserialization flaw. The issue is fixed in 2.0.38, and a workaround is documented in the linked advisory for those who cannot upgrade immediately. Because the framework itself is affected, any application that passes user-controlled data to unserialize() inherits the risk.

Impact

An unauthenticated attacker can execute arbitrary code in the context of the web application, leading to full server compromise. The CVSS scope change (S:C) reflects that impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network with no authentication and no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation requires the application to pass attacker-controlled input into unserialize(), so exposure depends on how the application uses the framework.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.788 (99.57th percentile), indicating strong predicted likelihood of exploitation. References are limited to patch and mitigation advisories, with no public exploit tag in the record.

What to do

• Upgrade yiisoft/yii2 to version 2.0.38 or later.
• If immediate upgrade is not possible, apply the workaround described in advisory GHSA-699q-wcff-g9mj.
• Audit application code for unserialize() calls on user-controlled input and replace them with safe alternatives such as JSON or explicit allow-listed types.
• Add input validation and integrity checks (for example signed or HMAC-protected serialized data) where serialization cannot be avoided.
• Restrict outbound network and process execution permissions for the web application to limit post-exploitation impact.

Detection

• Search application and framework code for unserialize() calls that receive request, cookie, header or other externally sourced data.
• Monitor web logs for requests carrying serialized PHP object payloads (for example strings containing O: or a: patterns) to endpoints that deserialize input.
• Alert on unexpected child processes, file writes or outbound connections spawned by the web server user, which can indicate successful RCE.
• Track Yii 2 version strings in deployed applications and flag any instance below 2.0.38.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.