High severity · published Sep 30, 2026
CVE-2026-103474
yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YI
yii2-starter-kit · yii2-starter-kit
through 4.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103474
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103474
issue-tracking
https://github.com/yii-starter-kit/yii2-starter-kit/issues/797
product
https://github.com/yii-starter-kit/yii2-starter-kit
technical-description
https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/backend/modules/file/controllers/StorageController.php#L36
third-party-advisory
https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unrestricted-file-upload-rce
More from yii2-starter-kit
9.1
CVE-2026-103475
yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
5.3
CVE-2026-103476
yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download