Vulnerability CVE-2020-36655
Published: 2023-01-21

Description:
Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

 References:
https://lab.wallarm.com/yii2-gii-remote-code-execution/
https://github.com/yiisoft/yii2-gii/issues/433
Copyright 2026, cxsecurity.com

 

Back to Top