Is CVE-2024-58136 exploited in the wild?

Yes. CVE-2024-58136 is known to be exploited in the wild, first recorded on 2 May 2025. Treat it as urgent.

How severe is CVE-2024-58136?

Critical severity, with a CVSS score of 3.1, published 10 April 2025.

Which products and versions are affected?

yiisoft/yii2 (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.52.

Is there a fix for CVE-2024-58136?

Yes. yiisoft/yii2 (Packagist): upgrade to 2.0.52 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-58136 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-58136?

Check whether you run yiisoft/yii2 (Packagist) or Yiiframework Yii at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58136: yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

CVE-2024-58136 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2025-04-10

Yii Framework 2 mishandles the attaching of behavior defined by an __class array key, resulting in an improper protection of alternate path vulnerability. This flaw is a regression of CVE-2024-4990 and allows remote attackers to execute arbitrary code. The vulnerability also impacts downstream products such as Craft CMS.

Technologies: yiisoft/yii2 (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2024-58136 exploited in the wild?: Yes. CVE-2024-58136 is known to be exploited in the wild, first recorded on 2 May 2025. Treat it as urgent.
How severe is CVE-2024-58136?: Critical severity, with a CVSS score of 3.1, published 10 April 2025.
Which products and versions are affected?: yiisoft/yii2 (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.52.
Is there a fix for CVE-2024-58136?: Yes. yiisoft/yii2 (Packagist): upgrade to 2.0.52 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58136 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-58136?: Check whether you run yiisoft/yii2 (Packagist) or Yiiframework Yii at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

yiisoft/yii2 (Packagist): upgrade to 2.0.52 or later
```
composer require yiisoft/yii2:^2.0.52
```

Affected products

Yiiframework Yii 2 before 2.0.52
Pixel & Tonic Craft CMS

Identifiers

CVE-2024-58136
GHSA-ggwg-cmwp-46r5

Timeline

2025-04-09: disclosed: NVD Published Date
2025-05-02: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2025-02: exploited: Exploitation in the wild began as early as February 2025
2025-04-28: patched: Yii 2.0.52 released to address the regression

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.