CVE-2025-2689: 
PHP vulnerability analysis and mitigation

A critical vulnerability has been discovered in yiisoft Yii2 versions up to 2.0.45 (CVE-2025-2689). The vulnerability affects the getIterator function in the symfony\finder\Iterator\SortableIterator.php file. This deserialization vulnerability can be exploited remotely, and a public exploit is available. The vulnerability was disclosed on March 24, 2025, and has received a CVSS v3.1 score of 9.8 (CRITICAL) (NVD).

The vulnerability is classified as a deserialization of untrusted data (CWE-502) and improper input validation (CWE-20) issue. The flaw exists in the getIterator() method of symfony\finder\Iterator\SortableIterator.php, where untrusted data can be deserialized without proper validation. This can lead to arbitrary command execution when a deserialization entry point is available (GitHub POC, VulDB Entry).

The vulnerability impacts system confidentiality, integrity, and availability. If successfully exploited, an attacker can achieve arbitrary command execution through deserialization, potentially leading to complete system compromise (VulDB Entry).

No official patches or mitigations have been reported at the time of disclosure. It is recommended to consider replacing the affected component with an alternative product until a security update is available (VulDB Entry).