GitHub Advisoryadvisory · Packagist

GHSA-5vpg-rj7q-qpw2 Yii 2: Local file inclusion via view parameter name collision

HIGH Published 2026-05-11 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-39850
Ecosystem
Packagist
Packages
yiisoft/yii2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20, CWE-98
Reviewed
2026-05-11

Affected packages

• Packagist yiisoft/yii2: < 2.0.55 → fixed in 2.0.55

Description

The core view rendering method `View::renderPhpFile()` calls `extract($_params_, EXTR_OVERWRITE)` before the `require` statement that includes the view file. A caller-controlled parameter named `_file_` in the `$params` array overwrites the internal local variable that specifies which file is included — enabling a Local File Inclusion primitive. Impact • Local File Inclusion (arbitrary file read via non-PHP files) • Potential RCE if attacker can write PHP files via a separate primitive • Information disclosure Patches 2.0.55 Workarounds No.

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program weakness

References