yiisoft Yii2 up to 2.0.39 MockClass.php generate deserialization

Summaryinfo

A vulnerability was found in yiisoft Yii2 up to 2.0.39. It has been classified as critical. This issue affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. Performing a manipulation results in deserialization. This vulnerability is identified as CVE-2025-2690. The attack can be initiated remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-2690. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept. By approaching the search of inurl:phpunit\src\Framework\MockObject\MockClass.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• yiisoft

Name

• Yii2

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18
• 2.0.19
• 2.0.20
• 2.0.21
• 2.0.22
• 2.0.23
• 2.0.24
• 2.0.25
• 2.0.26
• 2.0.27
• 2.0.28
• 2.0.29
• 2.0.30
• 2.0.31
• 2.0.32
• 2.0.33
• 2.0.34
• 2.0.35
• 2.0.36
• 2.0.37
• 2.0.38
• 2.0.39

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #521718: Yii Software LLC Yii 2.0 <=2.0.39 Deserialization (by gaorenyusi)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion