yii2-starter-kit: Unrestricted file upload leading to code execution
Summary
yii2-starter-kit through 4.2.0, a Yii 2 application template, does not validate file types in the backend storage upload actions. An authenticated user with the manager role can upload PHP files to the web-accessible storage directory and request them, which executes arbitrary code on the server. The attacker needs a manager-level account, but the flaw is rated high because it leads to full server compromise.
Affected
- yii2-starter-kit 0 to 4.2.0 (default: unaffected per CVE record)
- Affected code: backend/modules/file/controllers/StorageController.php
- Forks and custom builds based on the template may be affected.
Fixed in
Unknown. No vendor advisory or confirmed patched release was found.
Workaround
- Restrict the manager role to trusted users and review existing accounts holding it.
- Add an extension and MIME type allowlist to the upload actions.
- Block PHP execution in the upload and storage directories in the web server configuration.
- Store uploaded files outside the web root or with a safe extension.
Exploitation
- No known exploitation in the wild. CISA KEV listing not confirmed.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- The upstream issue describes the flaw and its location publicly. No public proof-of-concept exploit was found.
Our recommendation
- Inventory all systems running yii2-starter-kit, including forks, and record the version.
- Confirm the backend is not reachable from the internet.
- Check debug and Gii settings, which are related to CVE-2026-103475.
- Limit and review the manager role.
- Apply the upload restrictions and PHP execution blocking, then audit storage directories for unexpected script files.
- Monitor the upstream issue and the VulnCheck advisory and update once a fixed release is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- yii2-starter-kit repository github.com
- Affected code: StorageController.php github.com
- Upstream issue #797 github.com
- VulnCheck advisory www.vulncheck.com
- Strix CVE-2026-103474 www.strix.ai
- OpenCVE CVE-2026-103474 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:36.
Original description (NVD)
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.
NVD references (4)
- https://github.com/yii-starter-kit/yii2-starter-kit
- https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/backend/mod…
- https://github.com/yii-starter-kit/yii2-starter-kit/issues/797
- https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unrestricted-file-upload-rce
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.