CVE-2025-32027: Yii does not prevent XSS in scenarios where fallback error renderer is used
Impact Affected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used.
Patches Upgrade yiisoft/yii to version 1.1.31 or higher.
References - Git commit
If you have any questions or comments about this advisory, contact us through security form.
Other sources
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32027?
CVE-2025-32027 is classified as a moderate severity vulnerability due to the potential for reflected cross-site scripting (XSS) attacks.
How do I fix CVE-2025-32027?
To mitigate CVE-2025-32027, upgrade yiisoft/yii to version 1.1.31 or higher.
What causes CVE-2025-32027 in Yii framework?
CVE-2025-32027 is caused by the fallback error renderer handling user input in an unsafe manner, allowing for reflected XSS exploitation.
Is CVE-2025-32027 applicable to all versions of Yii?
CVE-2025-32027 affects all Yii framework versions prior to 1.1.31.
What impact does CVE-2025-32027 have on applications?
Applications using affected versions of Yii may be vulnerable to reflected XSS attacks, potentially compromising user data and session security.