CVE-2026-39850
HighSummary
Yii 2 is a PHP application framework, versions 2.0.54 and prior contain flawed logic in the view rendering method View::renderPhpFile() that leads to Local File Inclusion (LFI). A caller-controlled variable can overwrite the internal variable specifying which file to include.
Risk Assessment
The organization may be exposed to remote code execution (RCE) and information disclosure if an attacker can write PHP files through other primitives.
Recommendation
It is recommended to upgrade to version 2.0.55 or later to mitigate this vulnerability.
Original NVD description (English source)
Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled _file_ key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55.