CVE-2025-2690 is a Medium severity (CVSS 6.3) deserialization weakness reported in yiisoft Yii2 up to 2.0.39, tied to the Generate function in PHPUnit's MockClass.php. The record names no fixed version, so check your dependencies and the Yii advisories. Until then, remove PHPUnit from production builds.
What's affected
The record says Yii2 up to 2.0.39, and names the function Generate in the file phpunit/src/Framework/MockObject/MockClass.php. That is part of PHPUnit, a testing library, not Yii's runtime code.
No fixed version is named, and the one reference besides VulDB is a third party write up. Treat it as a report that the maintainers have not confirmed in the pages I read.
The point worth making is that PHPUnit is normally a development dependency. If your production deployment installs dev packages, the testing code ships to the server, and that is a deployment problem worth fixing whatever this CVE says.
How to check if you're exposed
See whether PHPUnit is present in your production artifact, and which Yii2 version you have:
composer show yiisoft/yii2
composer show phpunit/phpunit
composer install --no-dev --dry-run
If composer show phpunit/phpunit works on a production host, dev packages were installed there. Also search your code for untrusted deserialization:
grep -rn "unserialize(" --include=*.php . | grep -v vendor/
A package inventory will tell you what is installed, and the free in-browser dependency scan can check a manifest against known advisories.
What to do now
- Check which Yii2 and PHPUnit versions each application resolves.
- Rebuild production images with Composer's no dev option so testing libraries are not deployed.
- Look for an official statement from the Yii project on this CVE, since the record names no fix.
- Move Yii2 and its dependencies to current maintained versions.
- Replace any deserialization of untrusted data in your own code.
- Remove test tooling and debug endpoints from servers that face the internet.
Why it matters
The record lists CWE-20 and CWE-502. Deserialization of untrusted data is risky because the loading step can run code paths in classes that were never meant to see attacker influenced input. Libraries that offer many classes, such as mocking frameworks, widen the set of paths available.
The vector needs a low privilege account and rates impact as low across the board. The record says the exploit has been disclosed publicly, and the KEV flag is false.
A development library in a production build is an easy fix with real benefit. Even if this specific report does not apply to you, trimming dev dependencies reduces the number of advisories you have to chase.
Quick check
Should PHPUnit be on a production server?
Normally not. It is a testing tool. Install with Composer's no dev option for production builds.
Is there a fixed version?
The record does not name one. Check the Yii project's advisories and update to current maintained releases.
Sources
Last reviewed: 19 October 2026.
