CVE-2026-103474

HighCVSS 8.8/10Last modified Sep 30, 2026

Description

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1034759.1yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default develCVE-2026-1034765.3yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated atCVE-2026-1034786.4The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[biCVE-2026-1034806.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via thCVE-2026-1034816.1The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up tCVE-2026-1034825.4The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptin_fields[<custom_fieldCVE-2026-1034848.8IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.CVE-2026-1034887.1In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access reCVE-2026-1034895.4In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possibleCVE-2026-1034907.2In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group linksCVE-2026-1034916.5In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issuesCVE-2026-1034926.5In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
CVE-2026-103474: High severity, CVSS 8.8 | Vulnix