Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

Affected: Packagist: yiisoft/yii2

### Impact

Remote code execution in case application calls `unserialize()` on user input containing specially crafted string.

### Patches

2.0.38

### Workarounds

Add the following to BatchQueryResult.php:

```php public function __sleep() { throw new \BadMethodCallException('Cannot serialize '.__CLASS__); }

public function __wakeup() { throw new \BadMethodCallException('Cannot unserialize '.__CLASS__); } ```

### For more information

If you have any questions or comments about this advisory, [contact us through security form](https://www.yiiframework.com/security).