CVE-2024-4990

CVE-2024-4990 is a critical vulnerability in the yiisoft/yii2 framework (version 2.0.48) where the base Component class's __set() method lacks validation, enabling attackers to instantiate arbitrary classes and invoke methods. This allows for severe impacts including arbitrary code execution, sensitive information disclosure, and unauthorized access. With a CVSS score of 9.1 (CRITICAL), it presents a high-impact, low-complexity attack vector. While no public exploits like Metasploit or ExploitDB are available, the vulnerability has garnered significant community discussion and media coverage, including reports of a Craft CMS zero-day exploit, indicating potential active exploitation.