CVE-2024-4990 is a critical severity (CVSS 9.1) flaw in yiisoft/yii2 version 2.0.48. The base Component class __set() method does not check that a value is a valid Behavior class name or configuration, so an attacker could instantiate arbitrary classes. The NVD record names no fixed version, so check the project advisory.
What's affected
The record names yiisoft/yii2 version 2.0.48 as affected. The Huntr report page referenced in the record could not be retrieved during review, and the record does not list a fixed version.
Do not guess that the next release is safe. Check the Yii release notes and security advisories for the version that addresses CVE-2024-4990, and read the changes in the Component class.
The impact depends on your installed dependencies. The record says the possible effects range from code execution to information disclosure and unauthorised access, depending on which classes exist in your application.
How to check if you're exposed
Read the installed version of the framework with Composer.
composer show yiisoft/yii2
composer why yiisoft/yii2
If it shows 2.0.48, you are in the affected version. Then review where your code passes user controlled data into component properties, for example when you assign request data to a model or component attribute without an allow list. The weakness needs input that reaches the setter, so that code path is the thing to find.
What to do now
- Run Composer to find all projects using yiisoft/yii2 and note their versions.
- Read the Yii release notes and advisories and update to the version that addresses this CVE.
- Search your code for places that set component or behavior properties from request data.
- Use safe attribute lists and explicit assignment instead of mass assignment from input.
- Test the application after the update, since framework updates can change behavior.
Why it matters
The weakness is CWE-470 (Unsafe Reflection), also known as unsafe reflection. A framework that takes a class name or a configuration array from input and builds an object from it lets the caller choose what runs. With constructor arguments and setters also controllable, the attacker may chain existing classes in your dependency tree into something harmful.
This is why the record says the outcome depends on the installed dependencies. The bug is a stepping stone and what it leads to is decided by the libraries around it. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-4990.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version of Yii2 is affected?
The record names yiisoft/yii2 2.0.48.
Is there a confirmed fixed version?
Not in the record, so check the Yii advisories before you pick a target.
Sources
Last reviewed: 19 October 2026.
