Vikash Gupta

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.

**Name of the Vulnerable Software and Affected Versions** yii2-starter-kit versions prior to 4.2.0 **Description** The software exposes the Yii debug and Gii modules to all IP addresses by setting the `allowedIPs` variable to `['*']` in the default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data, such as session cookies and database queries, or use the Gii endpoint to generate and write PHP files into the application directory. **Recommendations** Update yii2-starter-kit to version 4.2.0 or later.

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.