CVE-2025-32027·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.23% — higher than 14% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Update the Yii framework component within your PHP installation to version 1.1.31 or later to eliminate the reflected XSS vulnerability in the fallback error renderer. This flaw allows attackers to inject malicious scripts through error pages when specific conditions are met. Apply the patch immediately to prevent potential session hijacking, credential theft, or malware injection via crafted error messages.

sudo dnf update php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET.*\?.*[<>%3C%3E].*script|onerror|onclick|javascript:|alert\(|onload=|Request URI contains unencoded angle brackets or event handler attributes in query parameters followed by error page rendering

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement WAF rules to block HTTP requests containing script tags, event handlers (onerror, onclick, onload), or JavaScript protocol handlers in query strings destined for error pages. Specifically, deny requests where error parameters contain patterns matching `(<script|javascript:|on\w+\s*=)`. Use output encoding middleware to escape HTML special characters in error messages before rendering.

How to check if you are affected

1. Run `php -v` to confirm your PHP version and verify if Yii framework is installed in your application directory
2. Check the Yii framework version by examining `composer.lock` or `yiisoft/yii/CHANGELOG.md` in your project: `grep -i 'yiisoft/yii' composer.lock | head -5`
3. Search application logs and web server access logs for unusual query strings in error pages, particularly those containing script tags or encoded JavaScript: `grep -i '<script\|onerror\|onclick' /var/log/apache2/access.log /var/log/nginx/access.log`
4. Verify the patch was applied by confirming Yii version is >= 1.1.31: `php -r "echo Yii::getVersion();"` or check the framework source directly

FAQ

Related PHP CVEs

References

• https://github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368
• https://github.com/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5