Wiz
Vulnerability DatabaseCVE-2017-20158

CVE-2017-20158: 
PHP vulnerability analysis and mitigation

Overview

A cross-site scripting (XSS) vulnerability was discovered in vova07 Yii2 FileAPI Widget versions up to 0.1.8. The vulnerability affects the run function in the actions/UploadAction.php file, where improper handling of the file argument could lead to XSS attacks (NVD).

Technical details

The vulnerability is classified as CWE-79 (Cross-site Scripting) and has been assigned a CVSS v3.1 score with the following metrics: AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. The issue specifically exists in the run function of actions/UploadAction.php where user input from the file argument was not properly encoded before being reflected back to users (GitHub Commit).

Impact

The vulnerability allows attackers to execute cross-site scripting attacks when manipulating the file argument, potentially leading to the injection of malicious scripts that could affect users interacting with the application (NVD).

Mitigation and workarounds

The vulnerability has been fixed in version 0.1.9 of the Yii2 FileAPI Widget. The fix involves properly encoding the error message using Html::encode() function. The patch can be identified by the commit hash c00d1e4fc912257fca1fce66d7a163bdbb4c8222 (GitHub Commit).

Additional resources

Source: This report was generated using AI

Related PHP vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-65346CRITICAL9.1
  • PHPPHP
  • alexusmai/laravel-file-manager
NoNoDec 04, 2025
CVE-2025-66468HIGH7.6
  • PHPPHP
  • aimeos/ai-cms-grapesjs
NoYesDec 02, 2025
CVE-2025-65345MEDIUM6.5
  • PHPPHP
  • alexusmai/laravel-file-manager
NoNoDec 03, 2025
CVE-2025-65657MEDIUM6.5
  • PHPPHP
  • feehi/cms
NoNoDec 02, 2025
CVE-2025-65186MEDIUM6.1
  • PHPPHP
  • getgrav/grav
NoNoDec 02, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo