CVE-2024-4990: Yii2 Component __set() allows arbitrary class instantiation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.1 with network reachability, no authentication or interaction, and very high EPSS plus public exploit references make this an urgent patch target.

What it is

In yiisoft/yii2 version 2.0.48, the base Component class __set() magic method fails to validate that a value is a valid Behavior class name or configuration. This lets an attacker instantiate arbitrary classes, pass parameters to their constructors, and invoke setter methods. Depending on installed dependencies, this can lead to code execution, sensitive information disclosure, or unauthorized access.

Impact

An attacker can instantiate attacker-chosen classes and control constructor arguments and setter calls, which may result in arbitrary code execution, retrieval of sensitive information, or unauthorized access depending on available dependencies.

Attack surface

The flaw is reachable remotely over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. It is triggered through the Component __set() magic method when attacker-controlled values are assigned.

Exploitation

No CISA KEV listing is present, but EPSS is very high at 0.80232 (99.598th percentile), and the only references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade yiisoft/yii2 to a version that fixes the __set() validation issue; version 2.0.48 is explicitly affected.
• If immediate upgrade is not possible, restrict or sanitize untrusted input that can reach Component property assignment, especially behavior configuration values.
• Review and minimize installed dependencies that expose dangerous constructors or setters, since exploitability depends on available classes.
• Apply least privilege to the web application process to limit the impact of arbitrary class instantiation and code execution.
• Monitor vendor advisories and the referenced huntr report for patch guidance and affected version details.

Detection

• Monitor application logs for unexpected class instantiation errors or unusual setter invocation patterns tied to Component property assignment.
• Hunt for requests that supply behavior-like configuration values to parameters later assigned via __set().
• Watch for post-exploitation indicators such as unexpected outbound connections, file writes, or process creation by the web server user.
• Use dependency and runtime monitoring to detect loading of classes not normally used by the application.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.