CVE-2025-32027 json
Yii does not prevent XSS in scenarios where fallback error renderer is used
published 2025-04-10 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-10695 , GHSA-7r2v-8wxr-3ch5
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | yiisoft/yii | <1.1.31 |
1.1.31 |
Affected products
- yiisoft yii
Classification
References
-
github.com
/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368
web, patch
-
github.com
/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-32027
advisory
-
github.com
/yiisoft/yii
package
Sources
- CVE List CVE-2025-32027
- GitHub Advisory GHSA-7r2v-8wxr-3ch5
- NVD CVE-2025-32027
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.