~ / search / GHSA-5vpg-rj7q-qpw2

GHSA-5vpg-rj7q-qpw2

Yii 2: Local file inclusion via view parameter name collision

Source: GitHub Advisory Database (reviewed) High CVE-2026-39850

Packages

EcosystemPackageAffectedFixed in
Packagist yiisoft/yii2 < 2.0.55 2.0.55

Details

As written in the advisory (Markdown source, shown as plain text).

The core view rendering method `View::renderPhpFile()` calls `extract($_params_, EXTR_OVERWRITE)` before the `require` statement that includes the view file. A caller-controlled parameter named `_file_` in the `$params` array overwrites the internal local variable that specifies which file is included — enabling a Local File Inclusion primitive. ### Impact - Local File Inclusion (arbitrary file read via non-PHP files) - Potential RCE if attacker can write PHP files via a separate primitive - Information disclosure ### Patches 2.0.55 ### Workarounds No.

References

External links from the advisory. They lead to third-party sites.