CVE-2024-58136: Yii 2 behavior attachment flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, confirmed in-the-wild exploitation, KEV listing and a very high EPSS score make this an urgent patch.

What it is

Yii 2 before 2.0.52 mishandles attaching a behavior defined by an __class array key, a regression of CVE-2024-4990. The flaw allows attacker-controlled input to influence class instantiation, which is why it carries a critical CVSS score and was exploited in the wild from February through April 2025.

Impact

An unauthenticated remote attacker can achieve code execution in the context of the affected application, gaining full control over confidentiality, integrity and availability of the host.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description does not identify the specific endpoint or parameter, so the exact request path must be determined from the application's use of behaviors.

Exploitation

CISA added it to KEV on 2025-05-02 with a 2025-05-23 remediation due date, and EPSS gives a 30-day probability of 0.87634 (99.75th percentile). References include an exploit-tagged third-party advisory describing an in-the-wild campaign, and the description states it was exploited in the wild in February through April 2025.

What to do

• Upgrade Yii 2 to 2.0.52 or later, which contains the patch commits referenced in the advisory.
• If immediate upgrade is not possible, follow the vendor advisory and CISA BOD 22-01 guidance, including discontinuing use of the product where mitigations are unavailable.
• Audit application code for behaviors attached from user-controlled input, especially arrays containing an __class key, and remove that pattern.
• Treat any internet-facing Yii 2 instance below 2.0.52 as compromised until logs are reviewed, given confirmed in-the-wild exploitation.

Detection

• Review web and application logs for requests that supply array parameters containing __class or behavior configuration keys.
• Hunt for unexpected process creation, outbound connections or file writes originating from the web server process.
• Check for signs of post-exploitation activity on hosts running Yii 2 below 2.0.52, including new files in web-accessible directories and modified application code.
• Inventory Yii 2 versions across internet-facing and internal applications to identify unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.