What is GHSA-7r2v-8wxr-3ch5?

GHSA-7r2v-8wxr-3ch5 is a security advisory published by GitHub Security Advisories with Medium severity. Yii does not prevent XSS in scenarios where fallback error renderer is used

Which CVE IDs does GHSA-7r2v-8wxr-3ch5 cover?

GHSA-7r2v-8wxr-3ch5 covers the following CVE IDs: CVE-2025-32027. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7r2v-8wxr-3ch5?

GHSA-7r2v-8wxr-3ch5 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-7r2v-8wxr-3ch5?

GHSA-7r2v-8wxr-3ch5 affects 1 product, including: composer/yiisoft/yii:\u003c 1.1.31.

GHSA-7r2v-8wxr-3ch5MediumCVSS 6.1

Yii does not prevent XSS in scenarios where fallback error renderer is used

Vendor

GitHub Security Advisories

Published

April 11, 2025

Last Modified

April 11, 2025

🔗 CVE IDs covered (1)

CVE-2025-32027 →

📋 Description

Impact

Affected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used.

Patches

Upgrade yiisoft/yii to version 1.1.31 or higher.

References

Git commit

If you have any questions or comments about this advisory, contact us through security form.

🎯 Affected products1

composer/yiisoft/yii:< 1.1.31

🔗 References (4)

https://github.com/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5
https://nvd.nist.gov/vuln/detail/CVE-2025-32027
https://github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368
https://github.com/advisories/GHSA-7r2v-8wxr-3ch5