Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.Referenceshttps://lab.wallarm.com/yii2-gii-remote-code-execution/https://github.com/yiisoft/yii2-gii/issues/433
