CVE-2025-32027: Yii does not prevent XSS in scenarios where fallback error renderer is used

April 11, 2025

Affected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used.

References

github.com/advisories/GHSA-7r2v-8wxr-3ch5
github.com/yiisoft/yii
github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368
github.com/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5
nvd.nist.gov/vuln/detail/CVE-2025-32027

Code Behaviors & Features

Detect and mitigate CVE-2025-32027 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →