Most recent entries from all

bdu:2020-05717

cnvd-2020-52394

EUVD-2026-42647

fkie_cve-2020-15148

Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

GHSA-699q-wcff-g9mj — Unsafe deserialization in Yii 2

Affected: Packagist: yiisoft/yii2

### Impact

Remote code execution in case application calls `unserialize()` on user input containing specially crafted string.

### Patches

2.0.38

### Workarounds

Add the following to BatchQueryResult.php:

```php public function __sleep() { throw new \BadMethodCallException('Cannot serialize '.__CLASS__); }

public function __wakeup() { throw new \BadMethodCallException('Cannot unserialize '.__CLASS__); } ```

### For more information