CVE-2026-103474 is a High severity unrestricted file upload flaw in yii2-starter-kit through version 4.2.0. A user with the manager role can upload a PHP file to the web accessible storage directory and run it, which gives code execution on the server. No fixed version is confirmed in the sources I read.
What's affected
- Product: yii2-starter-kit, a Yii 2 application template from the yii-starter-kit project.
- Affected: through 4.2.0, per the record.
- Fixed: not confirmed. The public issue was still open on the page I read.
- Precondition: an authenticated account with the manager role.
- Score: CVSS 8.8, High.
How to check if you're exposed
This is a template, so your project is a copy of it. Check the code that your project actually contains.
composer show -i | grep -i yii
grep -rn "validationRules" backend/modules/file/
ls storage/web/source | head
The first command lists installed Yii packages. The second looks at the upload controller for validation rules. The third shows whether the storage directory holds any file with a script extension that you did not expect.
Then check your web server configuration. The upstream issue says the storage virtual host passes PHP files to the PHP process manager, which is what turns an upload into execution. If your storage host serves only static files, that step does not happen. Review the list of users with the manager role as well.
What to do now
- Add an extension and MIME type allowlist to the backend upload actions, so only the file types you need are accepted.
- Store uploads outside the web root, or on a host that never executes scripts, and disable PHP execution in the storage directory at the web server.
- Save uploaded files with a safe generated name and extension rather than the original.
- Audit the storage directory for script files and remove any you did not put there.
- Review who has the manager role and remove it from accounts that do not need it.
- Watch the upstream issue and project releases for an official fix.
Why it matters
The record lists CWE-434, unrestricted upload of a file with a dangerous type. The upload actions define no validation rules, so any extension is accepted and the original extension is kept. The files land in a directory that the web server serves, and that server is set up to run PHP.
Two conditions limit the risk. The attacker needs the manager role, so this is not an anonymous attack. Still, a stolen or phished manager account is a common starting point, and the step from that account to code execution is short. That is how a content role becomes a server compromise.
The record does not list this CVE as exploited in the wild. The same public issue reports other problems in the project, so a wider review is worthwhile. Static analysis of your own code is the right check for this class of flaw.
Quick check
Does an attacker need an account?
Yes. The record says authenticated managers can upload the PHP files, so an account with the manager role is required.
What stops the uploaded file from running?
Validating file types, storing files outside the web root and turning off script execution in the storage directory each break the chain.
Sources
Last reviewed: 18 October 2026.
