Yii does not prevent XSS in scenarios where fallback error renderer is used

Description

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.

Scores

EPSS (exploitation in 30 days)

0.25% · top 84% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs
• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (opens in a new tab)All about CWE-80 and its CVEs

Affected products

• yiisoft · yii

  • affected < 1.1.31

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Packagistyiisoft/yiiGHSA-7r2v-8wxr-3ch5 (opens in a new tab)

References (2)

• https://github.com/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5 (opens in a new tab)x_refsource_CONFIRM
• https://github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-7r2v-8wxr-3ch5 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-32027](https://trackcve.app/badge/CVE-2025-32027.svg)](https://trackcve.app/cve/CVE-2025-32027)

Record last updated 10 Apr 2025, 14:54 UTC.