yiisoft Yii2 SortableIterator.php getIterator deserialization

5.3 CVSS

Vulnerability Description

A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2689

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

gaorenyusi (VulDB User)

References

More from yiisoft

View All →

CVE-2025-48493

Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

Medium 5.1

CVE-2025-32027

Yii does not prevent XSS in scenarios where fallback error renderer is used

Medium 6.1

CVE-2025-2690

yiisoft Yii2 MockClass.php generate deserialization

Medium 5.3

CVE-2024-4990

Unsafe Reflection in base Component class in yiisoft/yii2

High 8.1

CVE-2024-32877

Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

Medium 4.2

Affected Vendor

yiisoft

View all reports →

Affected Software

Yii2

Vulnerable Versions:

2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.20, 2.0.21, 2.0.22, 2.0.23, 2.0.24, 2.0.25, 2.0.26, 2.0.27, 2.0.28, 2.0.29, 2.0.30, 2.0.31, 2.0.32, 2.0.33, 2.0.34, 2.0.35, 2.0.36, 2.0.37, 2.0.38, 2.0.39, 2.0.40, 2.0.41, 2.0.42, 2.0.43, 2.0.44, 2.0.45