---
title: "Yii CVE-2024-58136: Framework Flaw Behind Craft CMS RCE"
url: https://erroneo.us/security/briefs/yii-cve-2024-58136-craft-cms-rce/
description: "Yii 2 before 2.0.52 lets crafted __class config reach object creation; chained into unauthenticated Craft CMS RCE in 2025. Upgrade Yii and Craft, then hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-02-13
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-58136"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Yii CVE-2024-58136: Framework Flaw Behind Craft CMS RCE

**Verdict: Check exposure.** Fixed in Yii 2.0.52 and in Craft 3.9.15, 4.14.15 and 5.6.17 since April 2025; confirm both versions, and if a Craft site sat unpatched in early 2025, look for dropped PHP files because upgrading does not remove them.

- **Who must act:** Owners of Craft CMS 3, 4 or 5 sites below 3.9.15, 4.14.15 or 5.6.17, and teams running Yii 2 applications before 2.0.52 that pass request data into object configuration.
- **Who can relax:** Craft Cloud customers, sites on patched Craft releases with Yii 2.0.52 or later, and Yii 3 or non-Yii PHP applications.
- **Affected:** Yii 2 before 2.0.52; Craft CMS 3.x before 3.9.15, 4.x before 4.14.15, 5.x before 5.6.17 (tracked as CVE-2025-32432)
- **Fixed:** Yii 2.0.52 (Feb 13, 2025); Craft CMS 3.9.15, 4.14.15 and 5.6.17 (Apr 10, 2025)
- **CVEs:** CVE-2024-58136
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run composer show yiisoft/yii2 and composer show craftcms/cms in each project and confirm Yii 2.0.52+ and a patched Craft release.
2. Upgrade Craft and its plugins to current releases; Craft's later releases also fix the separately exploited CVE-2024-56145 and CVE-2025-35939.
3. Until upgraded, block POST bodies to actions/assets/generate-transform that contain __class at the WAF or proxy, as Craft suggests.
4. If a site ran a vulnerable Craft version in 2025, follow Craft's compromise steps: take it offline, remove backdoors, update, then rotate CRAFT_SECURITY_KEY, environment secrets and database credentials.
5. For custom Yii 2 apps, audit any code that hands user-supplied arrays to Yii::createObject or component configuration.

### How to check if you are affected

- Search access logs for POST requests to actions/assets/generate-transform, especially many in a row, and GET requests to admin pages carrying PHP code in the query string.
- Search Craft logs for 'Image transform cannot be created' errors and POST bodies with fields that start with 'as' or contain __class.
- Look in the web root for filemanager.php, autoload_classmap.php, wp-22.php and style.php, and inspect PHP session files for injected code.
- Check access logs for the IPs Orange Cyberdefense published, such as 103.106.66[.]123 and 172.86.113[.]137.

## What happened

CVE-2024-58136 is a flaw in Yii 2, the PHP framework underneath Craft CMS and many custom applications. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-58136) says Yii before 2.0.52 "mishandles the attaching of behavior that is defined by an `__class` array key." It calls this a regression of the earlier fix for CVE-2024-4990, "as exploited in the wild in February through April 2025." Yii 2.0.50 had tried to fix that issue (GHSA-cjcc-p67m-7qxm). The [changelog](https://raw.githubusercontent.com/yiisoft/yii2/2.0.52/framework/CHANGELOG.md) lists the complete fix as Bug #20232 in 2.0.52, dated February 13, 2025. Yii only flagged it as a security release on April 9, in ["Please upgrade to Yii 2.0.52"](https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52), crediting Nicolas Bourras and Thomas Reynolds of Orange Cyberdefense. The record's own CVSS is 9.0. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-58136) scores it 9.8.

Orange Cyberdefense found the bug while investigating a hacked Craft CMS server. Its [write-up](https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/) says the attacker started around February 10, 2025, before any fix existed. The chain works like this. An unauthenticated POST to `/index.php?p=admin/actions/assets/generate-transform` carries a crafted object configuration that Yii turns into an unintended class. A GET to an admin page first stores PHP code in the session file's return URL. A second transform request then makes Yii load that session file and run the code. The attacker dropped an open-source PHP file manager, `filemanager.php`, later renamed `autoload_classmap.php`, plus other PHP files. Orange counted about 13,000 vulnerable Craft instances, and about 300 that appeared compromised.

Craft tracks its side as CVE-2025-32432, scored 10.0 by [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-32432). Its [advisory](https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432) says it got the report on April 7, 2025, shipped 3.9.15, 4.14.15 and 5.6.17 on April 10, and saw exploitation by April 17. CISA added the Yii CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-58136) on May 2, 2025, noting that it may affect other products built on Yii. It added CVE-2025-32432 itself on March 20, 2026.

## Who is affected

Craft CMS 3, 4 and 5 below the fixed releases, and any Yii 2 application before 2.0.52 that lets request data reach object configuration. Craft Cloud's firewall blocks the exploit. Craft sites also face two other exploited bugs, CVE-2024-56145 and CVE-2025-35939.

## Do you really need to act?

Check. The fix is 18 months old, but the attack needs no login, and Craft sites are often left on old versions. Upgrading does not clean a site that was already hit. As Orange puts it, "Upgrading to a new Craft CMS version does not remove any malicious files." For custom Yii apps, risk depends on whether user input reaches `Yii::createObject` or component configuration. Upgrading Yii removes the question.

## What to do now

1. Run `composer show yiisoft/yii2` and `composer show craftcms/cms` in each project.
2. Upgrade Craft, its plugins and Yii to current releases.
3. Until then, block POST bodies to `actions/assets/generate-transform` that contain `__class`.
4. If a site was exposed, take it offline, remove backdoors or redeploy from clean source, update, then rotate the key with `php craft setup/security-key`, plus environment secrets and database credentials.

## How to tell if you were hit

Search access logs for bursts of POSTs to `generate-transform`, and for admin-page GETs that redirect and carry PHP code in the query string. Search Craft logs for "Image transform cannot be created." Look for `filemanager.php`, `autoload_classmap.php`, `wp-22.php` and `style.php`, and inspect PHP session files. Orange lists attacker IPs, including 103.106.66[.]123.

## Timeline

- Feb 10, 2025 — The investigated Craft site is first attacked.
- Feb 13, 2025 — Yii 2.0.52 ships the fix as a bug fix.
- Apr 9, 2025 — Yii publishes its security notice; the CVE follows on April 10.
- Apr 10, 2025 — Craft releases 3.9.15, 4.14.15 and 5.6.17.
- May 2, 2025 — CISA adds CVE-2024-58136 to KEV.
- Mar 20, 2026 — CISA adds Craft's CVE-2025-32432 to KEV.

## Sources

1. [Yii — Please upgrade to Yii 2.0.52](https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52)
2. [Yii — Framework changelog (2.0.52, Bug #20232)](https://raw.githubusercontent.com/yiisoft/yii2/2.0.52/framework/CHANGELOG.md)
3. [Craft CMS — Craft CMS and CVE-2025-32432](https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432)
4. [Orange Cyberdefense (SensePost) — Investigating an in-the-wild campaign using RCE in CraftCMS](https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/)
5. [CVE record — CVE-2024-58136](https://www.cve.org/CVERecord?id=CVE-2024-58136)
6. [NVD — CVE-2024-58136](https://nvd.nist.gov/vuln/detail/CVE-2024-58136)
7. [CISA — Known Exploited Vulnerabilities: CVE-2024-58136](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-58136)
8. [NVD — CVE-2025-32432](https://nvd.nist.gov/vuln/detail/CVE-2025-32432)

---
Source page: https://erroneo.us/security/briefs/yii-cve-2024-58136-craft-cms-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt