The vulnerability allows unauthenticated remote attackers to reach the Yii debug and Gii modules, because the default development configuration sets allowedIPs to '*'. Attackers can view sensitive information such as session cookies and database queries via the debug endpoint, and can generate and write arbitrary PHP files into the application directory through the Gii endpoint. This can lead to remote code execution or compromise of the entire web application.

Yii2 Starter Kit versions through 4.2.0 are affected. The product exposes the debug and Gii modules to all IP addresses by default, affecting networks that host the application. This exposure applies to any installation that has not removed or reconfigured these modules before deployment to production.

The CVSS score of 9.3 indicates a high severity impact. Since EPSS is not available and the vulnerability is not listed in CISA KEV, there is no current exploitation data, but the attack vector is inferred to be remote network access to the web application. Unauthenticated attackers can exploit the exposed modules without any additional privileges, reading or writing sensitive data and potentially executing arbitrary code. Given the high score and the ease of exploitation, organizations should treat this as a critical risk and remediate immediately.