Critical severity · published Sep 30, 2026
CVE-2026-103475
yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YI
yii2-starter-kit · yii2-starter-kit
through 4.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103475
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103475
issue-tracking
https://github.com/yii-starter-kit/yii2-starter-kit/issues/797
product
https://github.com/yii-starter-kit/yii2-starter-kit
technical-description
https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/common/config/web.php#L21
third-party-advisory
https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-debug-and-gii-module-exposure
More from yii2-starter-kit
8.8
CVE-2026-103474
yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
5.3
CVE-2026-103476
yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download