yii2-starter-kit: Debug and Gii modules exposed to all IP addresses
Summary
The default development configuration of yii2-starter-kit through 4.2.0 sets allowedIPs to ['*'] for the Yii Debug and Gii modules, so they are reachable from any IP address. An unauthenticated remote attacker can read sensitive data such as session cookies and database queries via the debug endpoint. Via the Gii endpoint, the attacker can generate and write PHP files into the application directory, which may lead to code execution.
Affected
- yii2-starter-kit versions 0 to 4.2.0 (default development configuration)
- Deployments built from the default config with YII_DEBUG and YII_ENV_DEV enabled
Fixed in
Unknown.
Workaround
- Remove the wildcard from allowedIPs in common/config/web.php
- Disable the Debug and Gii modules in production
- Restrict the Debug and Gii modules to fixed administrator IP addresses; IP filtering alone is weak on shared networks
Exploitation
- No public proof of concept known
- Not known to be exploited in the wild
- CISA SSVC: Automatable yes, technical impact total
Our recommendation
- Check whether the debug and Gii routes are reachable from the internet and block or restrict them now
- Ensure YII_DEBUG and YII_ENV_DEV are disabled in production
- If exposed, review the application directory for unexpected PHP files, check logs, and rotate session secrets and credentials
- Monitor the GitHub issue and releases for a fix
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-103475 GitHub project github.com
- Vulnerable config file (common/config/web.php) github.com
- GitHub issue #797 github.com
- VulnCheck advisory www.vulncheck.com
- Strix CVE details www.strix.ai
- HOL Guard CVE details hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:47.
Original description (NVD)
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
NVD references (4)
- https://github.com/yii-starter-kit/yii2-starter-kit
- https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/common/conf…
- https://github.com/yii-starter-kit/yii2-starter-kit/issues/797
- https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-debug-and-gii-module-exposure
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.