CVE-2025-32027: Yiiframework Yii

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.

Affected products

• Yiiframework Yii: before 1.1.31 (fixed in 1.1.31)

Published 2025-04-10. Last modified 2026-06-17.