CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-103475 — yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP a...

·Source: NIST NVD

Updated:

Executive Summary

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.

Analysis

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory. CVSS Score: 9.1. Published: 2026-09-30T18:18:17.817.

Indicators of Compromise (1)

CVE (1)
CVE-2026-103475
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Bipartisan backlash to ALPRs grows as two high-profile bills are introduced

Republican Sen. Josh Hawley has new legislation on limiting automated license plate readers (ALPRs), while Democratic Sens. Bernie Sanders and Jeff Merkley, with Rep. Alexandria Ocasio-Cortez, have teed up a broader bill.

The Record
CRITICALVulnerability

NVD CRITICAL: CVE-2023-54405 — H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud plat...

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter without restricting path traversal or file type. Attackers can exploit the path traversal in the token pa

CVE-2023-54405
NIST NVD
CRITICALVulnerability

GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1. The flaw

The Hacker News