CVE-2026-103475: yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to [''] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict allowedIPs in the default development configuration instead of exposing the debug and Gii modules to all IP addresses.
Yii debug and Gii modules allowedIPs = trusted IP addresses, not ['*']
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of composer/trntv/yii2-starter-kit through 4.2.0 that use the default development configuration are exposed, because it sets allowedIPs to ['*'] for the Yii debug and Gii modules. This permits access from any IP address.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can access the exposed endpoints without user interaction.
What can an attacker do through the exposed modules?
The debug endpoint can disclose sensitive data, including session cookies and database queries. The Gii endpoint can be used to generate and write PHP files into the application directory.
What configuration change can reduce exposure if an update cannot be applied immediately?
Do not allow all IP addresses to access the debug and Gii modules. Restrict allowedIPs so that only trusted administrative or development IP addresses can reach them.