CVE-2026-103475

9.1 CRITICALpublic exploit available

Published 2026-09-30 · Updated 2026-09-30

AI risk analysis

Summary: The flaw allows unauthenticated attackers to access sensitive debug and Gii modules, exposing session cookies and database queries, and potentially writing PHP files to the application directory.
Exploitability: Exploitation is relatively easy as the allowedIPs setting is set to ['*'] by default, requiring only network access.
Blast radius: If exploited, the impact could be severe, including data theft and potential code injection leading to further compromise.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to yii2-starter-kit 4.2.1 or later.

webauth-bypassrcedebuggii

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-489

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.