CVE-2024-58136: Yiiframework Yii Improper Protection of Alternate Path Vulnerability
Summary: CVE-2024-58136 is an improper protection of alternate path vulnerability in the Yii Framework that may allow a remote attacker to execute arbitrary code. CISA notes the flaw could affect other products that implement Yii, including Craft CMS, as represented by CVE-2025-32432, and sets a remediation due date of 2025-05-23.
Why it matters: A remote code execution flaw in a framework that other products build on means the exposure extends past Yii itself to implementations like Craft CMS, and CISA's 2025-05-23 due date leaves a fixed window to find every place it is in use.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-58136Yiiframework
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026