CVE-2025-2689 is a Medium severity (CVSS 6.3) deserialization weakness reported in yiisoft Yii2 up to 2.0.45, tied to the getIterator function in a Symfony Finder iterator file. The record names no fixed version, so check Yii's advisories before relying on an upgrade.
What's affected
The record says Yii2 up to 2.0.45. The affected function is getIterator in the file symfony/finder/Iterator/SortableIterator.php, which is a Symfony component and not Yii code as such.
No fixed version is named. The only reference besides the VulDB entries is a third party write up on GitHub, which I could open but which is not an official advisory. Treat the report as unconfirmed by the maintainers until you see their statement.
That matters for how you respond. Because the weak code lives in a bundled or required dependency, the right question is whether your Yii2 application can reach it with untrusted data, and not only which version you run.
How to check if you're exposed
Check which Yii2 version your project resolves:
composer show yiisoft/yii2
composer show symfony/finder
Then see whether anything in your own code calls PHP's unserialize on data from users, cookies, queues or caches you do not control:
grep -rn "unserialize(" --include=*.php . | grep -v vendor/
If your code never feeds untrusted input into deserialization, the exposure is far smaller. Reachability analysis is the right idea here: knowing a library is present is different from knowing your code can reach the risky path. The free in-browser dependency scan is a quick way to see which advisories apply to your versions.
What to do now
- List every Yii2 application and the version Composer resolves for it.
- Check the Yii project's security page and release notes for an official statement on this CVE.
- Update Yii2 and Symfony Finder to current maintained releases as a normal hygiene step.
- Search your own code for deserialization of untrusted data and replace it with JSON or a safe format.
- Keep Composer dependencies in a lock file and review it in code review.
- Scan the dependency manifest to see whether other advisories apply to your versions.
Why it matters
The record lists CWE-20 (improper input validation) and CWE-502 (deserialization of untrusted data). Deserialization turns stored bytes back into live objects. If the bytes come from an attacker, the object can be built to trigger unwanted behaviour in classes that happen to be loaded.
The vector requires a logged in account and scores impact as low each, giving 6.3. The record says the exploit has been disclosed publicly, and it is not in the KEV catalog. A claim about a function in a dependency deserves a careful read: confirm the reachable path in your own code before treating it as a live threat.
A sibling report from the same author covers a second path in a different library, described in CVE-2025-2690.
Quick check
Is there a fixed Yii2 version for this CVE?
The record does not name one. Check the Yii project's advisories and move to a current maintained release.
Does having Symfony Finder installed mean I am exposed?
Not by itself. The report concerns deserialization, so the question is whether your code can pass untrusted data into that path.
Sources
Last reviewed: 19 October 2026.
