CVE-2020-15148
highpriority · attend · 77EPSS 0.775 · 100 %ileexploit · PoCEURUUSEPSS · scored 2026-10-27
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–10
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- 0xkami/cve-2020-15148cve-2020-15148PoC · poc_in_github
- Maskhe/CVE-2020-15148-bypasses几条关于CVE-2020-15148（yii2反序列化）的绕过PoC · poc_in_github
affected products (4)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-699q-wcff-g9mjUnsafe deserialization in Yii 22020-09-15ghsa · osvUS
### Impact Remote code execution in case application calls `unserialize()` on user input containing specially crafted string. ### Patches 2.0.38 ### Workarounds Add the following to BatchQueryResult.php: ```php public function __sleep() { throw new \BadMethodCallException('Cannot serialize '.__CLASS__); } public function __wakeup() { throw new \BadMethodCallException('Cannot unserialize '.__CLASS__); } ``` ### For more information If you have any questions or comments about this advisory, [contact us through security form](https://www.yiiframework.com/security).
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99cnnvd
- https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mjcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-15148cnnvd
- https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99enisa_euvd
- https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mjenisa_euvd
- https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99PatchThird Party Advisorynvd
- https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mjMitigationThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan