CVE-2020-15148
CriticalUnsafe deserialization in Yii 2
Published Sep 15, 2020 · Updated Aug 7, 2026 · Also known as GHSA-699q-wcff-g9mj
Key Facts
Patch immediately- CVE-2020-15148 is a critical-severity vulnerability (CVSS 10.0 v3.1) affecting Yii (Yiiframework), yiisoft/yii2 (composer), yii2.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 78% probability of exploitation in the next 30 days.
- Fixed versions are available, including Yii 2.0.38, yiisoft/yii2 2.0.38.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
78%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-15148 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| YiiYiiframework | See advisory | 2.0.38 |
| yiisoft/yii2composer | See advisory | 2.0.38 |
| yii2 | >= < 2.0.38 | n/a |
Patched Releases
Yii
2.0.38
yiisoft/yii2
2.0.38
Timeline
Publicly disclosed
Sep 15, 2020
Last updated
Aug 7, 2026
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- advisoryGHSA advisory
- advisoryhttps://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2020-15148.yaml
- advisoryhttps://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2020-15148
- advisoryhttps://www.yiiframework.com/news/303/yii-2-0-38
FAQ
Common Questions.
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input.
Affected: Yii (Yiiframework); yiisoft/yii2 (composer); yii2 versions >= < 2.0.38. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Yii 2.0.38, yiisoft/yii2 2.0.38.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-15148 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo