{"id":"CVE-2026-103475","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-103475","generatedAt":"2026-10-27T23:59:31.166Z","title":"yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration.","description":"yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.","published":"2026-09-30T18:18:18.000Z","lastModified":"2026-09-30T20:17:31.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":9.3,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-489"],"affected":[],"epss":{"score":0.00397,"percentile":0.33646,"date":"2026-10-26","history":[{"date":"2026-10-01","score":0.00671,"percentile":0.5023}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-30T18:18:18.000Z","detail":{"score":"9.3","severity":"CRITICAL","publishedAt":"2026-09-30T18:18:17.817Z"},"summary":"New CVE, critical severity (CVSS 9.3)."}],"references":[{"url":"https://github.com/yii-starter-kit/yii2-starter-kit","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/common/config/web.php#L21","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-debug-and-gii-module-exposure","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-103475","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}