yiisoft Yii2 MockClass.php generate deserialization

5.3 CVSS

Vulnerability Description

A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2690

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

gaorenyusi (VulDB User)

References

More from yiisoft

View All →

CVE-2025-48493

Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

Medium 5.1

CVE-2025-32027

Yii does not prevent XSS in scenarios where fallback error renderer is used

Medium 6.1

CVE-2025-2689

yiisoft Yii2 SortableIterator.php getIterator deserialization

Medium 5.3

CVE-2024-4990

Unsafe Reflection in base Component class in yiisoft/yii2

High 8.1

CVE-2024-32877

Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

Medium 4.2

Affected Vendor

yiisoft

View all reports →

Affected Software

Yii2

Vulnerable Versions:

2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.20, 2.0.21, 2.0.22, 2.0.23, 2.0.24, 2.0.25, 2.0.26, 2.0.27, 2.0.28, 2.0.29, 2.0.30, 2.0.31, 2.0.32, 2.0.33, 2.0.34, 2.0.35, 2.0.36, 2.0.37, 2.0.38, 2.0.39