Yii CVE-2024-58136: Framework Flaw Behind Craft CMS RCE

What to do

1. Run composer show yiisoft/yii2 and composer show craftcms/cms in each project and confirm Yii 2.0.52+ and a patched Craft release.
2. Upgrade Craft and its plugins to current releases; Craft's later releases also fix the separately exploited CVE-2024-56145 and CVE-2025-35939.
3. Until upgraded, block POST bodies to actions/assets/generate-transform that contain __class at the WAF or proxy, as Craft suggests.
4. If a site ran a vulnerable Craft version in 2025, follow Craft's compromise steps: take it offline, remove backdoors, update, then rotate CRAFT_SECURITY_KEY, environment secrets and database credentials.
5. For custom Yii 2 apps, audit any code that hands user-supplied arrays to Yii::createObject or component configuration.

How to check if you are affected or compromised

• Search access logs for POST requests to actions/assets/generate-transform, especially many in a row, and GET requests to admin pages carrying PHP code in the query string.
• Search Craft logs for 'Image transform cannot be created' errors and POST bodies with fields that start with 'as' or contain __class.
• Look in the web root for filemanager.php, autoload_classmap.php, wp-22.php and style.php, and inspect PHP session files for injected code.
• Check access logs for the IPs Orange Cyberdefense published, such as 103.106.66[.]123 and 172.86.113[.]137.

What happened#

CVE-2024-58136 is a flaw in Yii 2, the PHP framework underneath Craft CMS and many custom applications. The CVE record says Yii before 2.0.52 "mishandles the attaching of behavior that is defined by an __class array key." It calls this a regression of the earlier fix for CVE-2024-4990, "as exploited in the wild in February through April 2025." Yii 2.0.50 had tried to fix that issue (GHSA-cjcc-p67m-7qxm). The changelog lists the complete fix as Bug #20232 in 2.0.52, dated February 13, 2025. Yii only flagged it as a security release on April 9, in "Please upgrade to Yii 2.0.52", crediting Nicolas Bourras and Thomas Reynolds of Orange Cyberdefense. The record's own CVSS is 9.0. NVD scores it 9.8.

Orange Cyberdefense found the bug while investigating a hacked Craft CMS server. Its write-up says the attacker started around February 10, 2025, before any fix existed. The chain works like this. An unauthenticated POST to /index.php?p=admin/actions/assets/generate-transform carries a crafted object configuration that Yii turns into an unintended class. A GET to an admin page first stores PHP code in the session file's return URL. A second transform request then makes Yii load that session file and run the code. The attacker dropped an open-source PHP file manager, filemanager.php, later renamed autoload_classmap.php, plus other PHP files. Orange counted about 13,000 vulnerable Craft instances, and about 300 that appeared compromised.

Craft tracks its side as CVE-2025-32432, scored 10.0 by NVD. Its advisory says it got the report on April 7, 2025, shipped 3.9.15, 4.14.15 and 5.6.17 on April 10, and saw exploitation by April 17. CISA added the Yii CVE to KEV on May 2, 2025, noting that it may affect other products built on Yii. It added CVE-2025-32432 itself on March 20, 2026.

Who is affected#

Craft CMS 3, 4 and 5 below the fixed releases, and any Yii 2 application before 2.0.52 that lets request data reach object configuration. Craft Cloud's firewall blocks the exploit. Craft sites also face two other exploited bugs, CVE-2024-56145 and CVE-2025-35939.

Do you really need to act?#

Check. The fix is 18 months old, but the attack needs no login, and Craft sites are often left on old versions. Upgrading does not clean a site that was already hit. As Orange puts it, "Upgrading to a new Craft CMS version does not remove any malicious files." For custom Yii apps, risk depends on whether user input reaches Yii::createObject or component configuration. Upgrading Yii removes the question.

What to do now#

1. Run composer show yiisoft/yii2 and composer show craftcms/cms in each project.
2. Upgrade Craft, its plugins and Yii to current releases.
3. Until then, block POST bodies to actions/assets/generate-transform that contain __class.
4. If a site was exposed, take it offline, remove backdoors or redeploy from clean source, update, then rotate the key with php craft setup/security-key, plus environment secrets and database credentials.

How to tell if you were hit#

Search access logs for bursts of POSTs to generate-transform, and for admin-page GETs that redirect and carry PHP code in the query string. Search Craft logs for "Image transform cannot be created." Look for filemanager.php, autoload_classmap.php, wp-22.php and style.php, and inspect PHP session files. Orange lists attacker IPs, including 103.106.66[.]123.

Timeline#

• Feb 10, 2025 — The investigated Craft site is first attacked.
• Feb 13, 2025 — Yii 2.0.52 ships the fix as a bug fix.
• Apr 9, 2025 — Yii publishes its security notice; the CVE follows on April 10.
• Apr 10, 2025 — Craft releases 3.9.15, 4.14.15 and 5.6.17.
• May 2, 2025 — CISA adds CVE-2024-58136 to KEV.
• Mar 20, 2026 — CISA adds Craft's CVE-2025-32432 to KEV.

Vulnerability records

• CVE-2024-58136 · KEV 2025-05-02 · Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Yii — Please upgrade to Yii 2.0.52 yiiframework.com
2. Yii — Framework changelog (2.0.52, Bug #20232) raw.githubusercontent.com
3. Craft CMS — Craft CMS and CVE-2025-32432 craftcms.com
4. Orange Cyberdefense (SensePost) — Investigating an in-the-wild campaign using RCE in CraftCMS sensepost.com
5. CVE record — CVE-2024-58136 cve.org
6. NVD — CVE-2024-58136 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2024-58136 cisa.gov
8. NVD — CVE-2025-32432 nvd.nist.gov