{"id":"CVE-2026-103474","published":"2026-09-30T18:18:17.647","lastModified":"2026-09-30T19:08:43.927","description":"yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://github.com/yii-starter-kit/yii2-starter-kit","tags":[]},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/backend/modules/file/controllers/StorageController.php#L36","tags":[]},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","tags":[]},{"url":"https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unrestricted-file-upload-rce","tags":[]}],"exploitRefs":[{"url":"https://github.com/yii-starter-kit/yii2-starter-kit","tags":[]},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/backend/modules/file/controllers/StorageController.php#L36","tags":[]},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated managers to upload PHP files, enabling arbitrary code execution on the server.","exploitability":"Exploitation is relatively straightforward for attackers with manager roles, requiring only file upload and execution.","blast_radius":"If exploited, the impact could be severe, allowing full server compromise and arbitrary code execution.","remediation":"Upgrade to yii2-starter-kit 4.2.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","auth-bypass"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:50:51.170Z"}}