CVE-2026-103474
8.8 HIGHpublic exploit availablePublished 2026-09-30 · Updated 2026-09-30
AI risk analysis
- Summary
- The flaw allows authenticated managers to upload PHP files, enabling arbitrary code execution on the server.
- Exploitability
- Exploitation is relatively straightforward for attackers with manager roles, requiring only file upload and execution.
- Blast radius
- If exploited, the impact could be severe, allowing full server compromise and arbitrary code execution.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to yii2-starter-kit 4.2.1 or later.
rcewebauth-bypass
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Public exploit & PoC references
All references
- https://github.com/yii-starter-kit/yii2-starter-kit
- https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/backend/modules/file/controllers/StorageController.php#L36
- https://github.com/yii-starter-kit/yii2-starter-kit/issues/797
- https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unrestricted-file-upload-rce
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-104800
- HIGHCVE-2026-105123PoC
- HIGHCVE-2026-105701
- HIGHCVE-2026-17196PoC
- HIGHCVE-2026-36467PoC
- HIGHCVE-2026-6147
- HIGHCVE-2026-88419PoC
- HIGHCVE-2026-93031
Related by shared AI tags and CWE weakness class. Browse the full archive.