CVE-2025-2689
Published: 24 March 2025
Summary
CVE-2025-2689 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Yiiframework Yii. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2689 is a critical vulnerability affecting yiisoft Yii2 up to version 2.0.45, specifically in the getIterator function of the symfony\finder\Iterator\SortableIterator.php file. It stems from improper input validation (CWE-20) leading to deserialization (CWE-502). Published on 2025-03-24T07:15:14.010, the issue has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability enables remote exploitation by an attacker possessing low privileges. With low attack complexity and no user interaction required, successful manipulation can result in limited impacts to confidentiality, integrity, and availability.
Advisories and details on the issue, including the publicly disclosed exploit, are available via VulDB entries (https://vuldb.com/?ctiid.300710, https://vuldb.com/?id.300710, https://vuldb.com/?submit.521709) and a GitHub resource (https://github.com/gaorenyusi/gaorenyusi/blob/main/Yii2.md).
The exploit has been disclosed to the public and may be used, heightening the risk for affected Yii2 deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7345
Vulnerability details
A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The…
more
exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-2689 is a critical remote deserialization vulnerability in the Yii2 web framework (using Symfony Finder), exploitable in public-facing applications to achieve arbitrary code execution, directly mapping to exploitation of public-facing applications for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the critical deserialization flaw in Yii2's SortableIterator by requiring timely patching or upgrading to a version beyond 2.0.45.
Addresses the root cause of improper input validation (CWE-20) by enforcing validation of inputs to the vulnerable getIterator function, preventing malicious deserialization payloads.
Enables identification of the specific CVE-2025-2689 vulnerability in Yii2 deployments through regular scanning, facilitating proactive remediation.