CVE-2025-2689: yiisoft Yii2 SortableIterator.php getIterator deserialization
A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2689?
CVE-2025-2689 is classified as a critical vulnerability.
What software versions are affected by CVE-2025-2689?
CVE-2025-2689 affects versions of yiisoft Yii2 up to 2.0.45.
How do I fix CVE-2025-2689?
To fix CVE-2025-2689, update yiisoft Yii2 to the latest version beyond 2.0.45.
What type of vulnerability is CVE-2025-2689?
CVE-2025-2689 is a deserialization vulnerability that can be exploited remotely.
Where is the vulnerable function in CVE-2025-2689 located?
The vulnerability in CVE-2025-2689 is located in the getIterator function of the file symfony\finder\Iterator\SortableIterator.php.