CVE-2024-58136 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-04-10

Added to CISA KEV: 2025-05-02 22 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately upgrade to Yii 2.0.52 or later versions
Review application logs for suspicious requests targeting behavior attachment mechanisms
Implement web application firewall rules to detect exploitation attempts
Conduct security audit of all Yii-based applications in the environment
Monitor for unauthorized file uploads or modifications on web servers

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2024-58136 is a critical remote code execution (RCE) vulnerability affecting the Yii 2 PHP framework ^[1] ^[3]. It is a regression of a previously patched vulnerability, CVE-2024-4990, involving the mishandling of behavior attachments defined by an `__class` array key ^[2] ^[4].

Key Details

Feature	Description
Vulnerability Type	Remote Code Execution (RCE) ^[1]
CVSS Score	9.8 (Critical) ^[1]
Affected Versions	Yii 2 before 2.0.52 ^[2]
Exploitation Status	Confirmed active exploitation in the wild (Feb–Apr 2025) ^[2]
Mitigation	Upgrade to Yii 2 version 2.0.52 or later ^[1]

Analysis and Impact

Active Exploitation: The vulnerability was actively exploited in the wild between February and April 2025 ^[2].
Attack Method: The flaw exists because the framework improperly handles behavior attachments when defined via an `__class` array key, allowing attackers to bypass previous security controls and achieve code execution ^[4] ^[5].
Access/Impact: Successful exploitation grants an attacker the ability to execute arbitrary code on the underlying server, typically leading to a full system compromise ^[1].
Exploit Availability: Technical analyses, including deep dives into the exploit mechanism and mitigation strategies, have been published by security researchers and platforms like AttackerKB, making the nature of the exploit well-documented for the security community ^[3] ^[6].
Targeted Attacks/Ransomware: While the vulnerability was exploited in the wild, specific attribution to ransomware campaigns or targeted advanced persistent threat (APT) groups is not explicitly detailed in standard CVE databases, though its critical nature makes it a high-value target for such actors.

Sources