CVE-2025-2689

CVE-2025-2689 is a critical deserialization vulnerability affecting yiisoft Yii2 versions up to 2.0.45, specifically within the getIterator function of symfony\finder\Iterator\SortableIterator.php. This flaw allows for remote exploitation with no user interaction required, carrying a CVSS score of 9.8, indicating a severe risk of complete compromise of confidentiality, integrity, and availability. While the exploit has been publicly disclosed and the vulnerability has garnered significant community discussion, there is currently no evidence of active exploitation in the wild, nor are there readily available exploits in common frameworks like Metasploit or Nuclei.