{"id":"CVE-2026-103475","published":"2026-09-30T18:18:17.817","lastModified":"2026-09-30T20:17:31.447","description":"yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-489"],"vendors":[],"products":[],"references":[{"url":"https://github.com/yii-starter-kit/yii2-starter-kit","tags":[]},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/common/config/web.php#L21","tags":[]},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","tags":[]},{"url":"https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-debug-and-gii-module-exposure","tags":[]}],"exploitRefs":[{"url":"https://github.com/yii-starter-kit/yii2-starter-kit","tags":[]},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/common/config/web.php#L21","tags":[]},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows unauthenticated attackers to access sensitive debug and Gii modules, exposing session cookies and database queries, and potentially writing PHP files to the application directory.","exploitability":"Exploitation is relatively easy as the allowedIPs setting is set to ['*'] by default, requiring only network access.","blast_radius":"If exploited, the impact could be severe, including data theft and potential code injection leading to further compromise.","remediation":"Upgrade to yii2-starter-kit 4.2.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","auth-bypass","rce","debug","gii"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:46:33.510Z"}}