CVE-2025-32027: Yiiframework Yii XSS Vulnerability

CVE-2025-32027 Overview

CVE-2025-32027 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Yii PHP web framework. The flaw affects yiisoft/yii versions prior to 1.1.31. Attackers can trigger the vulnerability when the fallback error renderer processes error messages without proper HTML encoding. The unsanitized error output allows injection of arbitrary JavaScript into the response rendered to a victim's browser.

The vulnerability is tracked as [CWE-79] and requires user interaction to exploit. It carries a network attack vector with low privileges required. Yii maintainers released version 1.1.31 to remediate the issue.

Critical Impact
Successful exploitation enables session compromise, credential theft, and execution of attacker-controlled JavaScript in the context of the victim's browser session.

Affected Products

Yii Framework (yiisoft/yii) versions prior to 1.1.31
PHP applications using the Yii 1.x fallback error renderer
Web applications running with YII_DEBUG enabled

Discovery Timeline

2025-04-10 - CVE-2025-32027 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32027

Vulnerability Analysis

The vulnerability resides in the fallback error rendering routine of Yii's CApplication class. When a PHP error triggers the fallback renderer, the framework echoes the error $message and $file values directly into the HTML response. No HTML entity encoding is applied to these values before output.

An attacker crafts a request that causes an error containing attacker-controlled content, such as a malformed parameter reflected in an error message. The unsanitized content executes as JavaScript when the response renders in a victim's browser. The vulnerability requires user interaction, typically through a crafted link.

Root Cause

The fallback error renderer in framework/base/CApplication.php failed to call an HTML encoding function on error message components. The raw $message and $file variables reached the HTML output stream. This absence of output encoding on user-influenced error content produced the reflected XSS sink.

Attack Vector

Exploitation requires the target application to run with YII_DEBUG enabled and to reach the fallback error handler. An attacker sends a specially crafted request that induces a PHP error whose message or file path contains attacker-supplied HTML or JavaScript. When the victim loads the attacker's link, the payload executes in the victim's browser under the application's origin.

php

// Patch excerpt from framework/base/CApplication.php
if(YII_DEBUG)
{
    echo "<h1>PHP Error [$code]</h1>\n";
-   echo "<p>$message ($file:$line)</p>\n";
+   echo "<p>".nl2br($this->htmlEncodeInternal($message))." (".$this->htmlEncodeInternal($file).":$line)</p>\n";
    echo '<pre>';

    $trace=debug_backtrace();

Source: GitHub commit d386d73. The patch introduces htmlEncodeInternal() calls around the $message and $file values before echoing them.

Detection Methods for CVE-2025-32027

Indicators of Compromise

Web server access logs containing requests with <script>, javascript:, or encoded HTML tags in query parameters or path segments
Error log entries with reflected user input followed by 200 responses containing the same input in HTML context
Outbound requests from user browsers to unexpected third-party domains after visiting application error pages
Unusual session activity or authentication token reuse from geographically inconsistent locations

Detection Strategies

Inspect application responses for reflected request parameters inside <p> tags following <h1>PHP Error markers
Deploy Web Application Firewall (WAF) signatures for XSS patterns targeting Yii error page structures
Audit YII_DEBUG configuration across production environments to identify systems exposing the vulnerable renderer
Correlate error log spikes with inbound requests containing HTML metacharacters

Monitoring Recommendations

Monitor for high volumes of 500-class responses containing HTML-encoded content in URL parameters
Alert on Content Security Policy (CSP) violation reports referencing inline script execution on error pages
Track version inventory of yiisoft/yii across application dependencies to identify unpatched deployments

How to Mitigate CVE-2025-32027

Immediate Actions Required

Upgrade yiisoft/yii to version 1.1.31 or later across all applications
Disable YII_DEBUG in production environments to prevent the fallback renderer from executing
Review dependency manifests (composer.json) for pinned Yii versions below 1.1.31
Rotate any session tokens or credentials that may have been exposed through the vulnerable error pages

Patch Information

The fix is available in Yii 1.1.31 and is applied via commit d386d737861c9014269b7ed8c36c65eadb387368. Refer to the GitHub Security Advisory GHSA-7r2v-8wxr-3ch5 for full remediation guidance and the upstream commit for code-level changes.

Workarounds

Set YII_DEBUG to false in index.php to bypass the vulnerable fallback renderer path
Implement a strict Content Security Policy (CSP) that blocks inline scripts on application responses
Deploy WAF rules to filter requests containing HTML metacharacters in parameters that reach error handlers

bash

# Update Yii via Composer
composer require yiisoft/yii:^1.1.31
composer update yiisoft/yii

# Disable debug mode in production index.php
# Replace: defined('YII_DEBUG') or define('YII_DEBUG', true);
# With:    defined('YII_DEBUG') or define('YII_DEBUG', false);