Is CVE-2026-103475 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103475 being exploited in the wild.

How severe is CVE-2026-103475?

Critical severity, with a CVSS score of 9.1, published 30 September 2026.

Which products and versions are affected?

Yii-Starter-Kit Yii2-Starter-Kit through 4.2.0.

Is there a fix for CVE-2026-103475?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103475 attacked?

It is attacked over the network.

Am I affected by CVE-2026-103475?

Check whether you run Yii-Starter-Kit Yii2-Starter-Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103475: yii2-starter-kit insecure allowedIPs configuration in debug and Gii modules

CVE-2026-103475 · Severity: critical · CVSS 9.1 · Published 2026-09-30

yii2-starter-kit is a template for building web applications using the Yii framework. The starter kit's default development configuration exposes debugging and code generation tools to any network user by permitting access from all IP addresses. An unauthenticated attacker on the network can read sensitive data such as database queries and session credentials, or generate and write arbitrary PHP code to the application directory, leading to complete compromise.

Technologies: Yii-Starter-Kit Yii2-Starter-Kit. Vendors: Yii-Starter-Kit.

Quick answers

Is CVE-2026-103475 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103475 being exploited in the wild.
How severe is CVE-2026-103475?: Critical severity, with a CVSS score of 9.1, published 30 September 2026.
Which products and versions are affected?: Yii-Starter-Kit Yii2-Starter-Kit through 4.2.0.
Is there a fix for CVE-2026-103475?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103475 attacked?: It is attacked over the network.
Am I affected by CVE-2026-103475?: Check whether you run Yii-Starter-Kit Yii2-Starter-Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from setting allowedIPs to ['*'] for the Yii debug and Gii modules in the default web.php configuration when YII_DEBUG or YII_ENV_DEV are enabled. The debug module exposes sensitive runtime information including session cookies and database query logs; the Gii module allows code generation and file writes without authentication. An unauthenticated network attacker can directly access these endpoints to extract secrets or achieve remote code execution.

Affected products

yii-starter-kit yii2-starter-kit through 4.2.0

Timeline

2026-09-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.