CVE-2025-2690: yiisoft Yii2 MockClass.php generate deserialization
Published Mar 24, 2025
·Updated
A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
2 affected components
yiisoft Yii2<=2.0.39
Yiiframework Yii>=2.0.0<=2.0.39
Event History
Mar 24, 2025
CVE Published
via MITRE·07:31 AM
Data Sourced
via MITRE·07:31 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-2690?
CVE-2025-2690 is classified as a critical vulnerability.
2
How do I fix CVE-2025-2690?
To fix CVE-2025-2690, update yiisoft Yii2 to version 2.0.40 or later.
3
What type of vulnerability is CVE-2025-2690?
CVE-2025-2690 is a deserialization vulnerability affecting the Generate function.
4
Can CVE-2025-2690 be exploited remotely?
Yes, CVE-2025-2690 allows for remote exploitation.
5
Which versions of Yii2 are affected by CVE-2025-2690?
CVE-2025-2690 affects all versions of Yii2 up to and including 2.0.39.