{"id":"CVE-2026-103474","state":"PUBLISHED","title":"yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE","description":"yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.","publishedAt":"2026-09-30T17:22:41.048Z","updatedAt":"2026-09-30T17:50:39.433Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["yii2-starter-kit yii2-starter-kit"],"affected":[{"vendor":"yii2-starter-kit","product":"yii2-starter-kit","packageURL":"pkg:composer/yii2-starter-kit/yii2-starter-kit","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.2.0","versionType":"custom"}]}],"references":["https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","https://github.com/yii-starter-kit/yii2-starter-kit","https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/backend/modules/file/controllers/StorageController.php#L36","https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unrestricted-file-upload-rce"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/103xxx/CVE-2026-103474.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-103474","state":"PUBLISHED","datePublished":"2026-09-30T17:22:41.048Z","dateUpdated":"2026-09-30T17:50:39.433Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-30T16:03:00.349Z"},"containers":{"cna":{"title":"yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE","descriptions":[{"lang":"en","value":"yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server."}],"affected":[{"vendor":"yii2-starter-kit","product":"yii2-starter-kit","packageURL":"pkg:composer/yii2-starter-kit/yii2-starter-kit","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.2.0","versionType":"custom"}]}],"references":[{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","tags":["issue-tracking"],"name":"GitHub Issue #797"},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit","tags":["product"]},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/backend/modules/file/controllers/StorageController.php#L36","tags":["technical-description"]},{"url":"https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unrestricted-file-upload-rce","name":"VulnCheck Advisory: yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","lang":"en","description":"Unrestricted Upload of File with Dangerous Type","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-30T17:22:41.048Z"},"datePublic":"2026-09-30T00:00:00.000Z","credits":[{"lang":"en","value":"Vikash Gupta","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-30T17:44:26.126873Z","id":"CVE-2026-103474","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-30T17:50:39.433Z"}}]}}}