CVE-2025-2689: yiisoft Yii2 SortableIterator.php getIterator deserialization
First published: Mon Mar 24 2025(Updated: )
A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Yii Framework 2 | <=2.0.45 | |
| Yii Framework | >=2.0.0<=2.0.45 | |
| composer/yiisoft/yii2-dev | <=2.0.45 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2689?
CVE-2025-2689 is classified as a critical vulnerability.
What software versions are affected by CVE-2025-2689?
CVE-2025-2689 affects versions of yiisoft Yii2 up to 2.0.45.
How do I fix CVE-2025-2689?
To fix CVE-2025-2689, update yiisoft Yii2 to the latest version beyond 2.0.45.
What type of vulnerability is CVE-2025-2689?
CVE-2025-2689 is a deserialization vulnerability that can be exploited remotely.
Where is the vulnerable function in CVE-2025-2689 located?
The vulnerability in CVE-2025-2689 is located in the getIterator function of the file symfony\finder\Iterator\SortableIterator.php.
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- agent/severity
- collector/nvd-api
- source/NVD
- agent/references
- agent/last-modified-date
- agent/source
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-88m2-j94x-v4fx
- alias/CVE-2025-2689
- collector/nvd-cve
- agent/softwarecombine
- agent/tags
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- vendor/yiisoft
- canonical/yii framework 2
- vendor/yiiframework
- canonical/yii framework
- version/yii framework/2.0.0
- version/yii framework/2.0.45
- package-manager/composer