6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-32027

CVE-2025-32027: Yii does not prevent XSS in scenarios where fallback error renderer is used

Impact

Affected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used.

Patches

Upgrade yiisoft/yii to version 1.1.31 or higher.

References

Git commit

If you have any questions or comments about this advisory, contact us through security form.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-32027

CVE-2025-32027:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
yiisoft/yii	composer	< 1.1.31	1.1.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the fallback error and exception renderers in the Yii framework. The provided commit d386d737861c9014269b7ed8c36c65eadb387368 modifies the CApplication.php file. Specifically, the functions displayError and displayException within the CApplication class were updated. Before the patch, these functions directly outputted error messages, file paths, line numbers, and exception details (including stack traces) into HTML without proper sanitization. This made them susceptible to Reflected Cross-Site Scripting (XSS) if an attacker could control any part of the data being displayed (e.g., by causing an error with a malicious message). The patch introduces a new private method htmlEncodeInternal which uses htmlspecialchars to encode the output. This new method is then used to wrap the previously vulnerable variables within displayError and displayException before they are echoed. Therefore, CApplication::displayError and CApplication::displayException are the functions that were vulnerable and would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.