{"id":"CVE-2026-39850","published":"2026-05-20T19:51:03Z","modified":"2026-05-21T13:03:41Z","title":"Yii 2: Local file inclusion via view parameter name collision","vendor":"yiisoft","product":"yii2","tier":"tail","description":{"text":"Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled _file_ key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00455,"percentile":0.39394,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-98","name":"Improper Control of Filename for Include/Require Statement in PHP Program"}],"references":[{"url":"https://github.com/yiisoft/yii2/security/advisories/GHSA-5vpg-rj7q-qpw2","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/yiisoft/yii2/commit/109878b491dbffa541032bc99fb5e26d12cd0375","tags":["x_refsource_MISC"]}],"priority":{"score":13.1,"factors":[{"name":"EPSS percentile","points":7.88},{"name":"CVSS severity","points":5.18}]},"vendorSlug":"yiisoft","affectedVersions":[{"vendor":"yiisoft","product":"yii2","versions":["< 2.0.55"]}],"affected":[{"ecosystem":"Packagist","package":"yiisoft/yii2","vulnerableRanges":["<2.0.55"],"patched":["2.0.55"],"from":["GHSA-5vpg-rj7q-qpw2"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-31190","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-32877","published":"2024-05-30","fixed":"2.0.49.4","kev":false},{"cve":"CVE-2024-4990","published":"2025-03-20","fixed":"2.0.49.4","kev":false},{"cve":"CVE-2024-58136","published":"2025-04-10","fixed":"2.0.52","kev":true,"link":{"from":"CVE-2024-58136","to":"CVE-2026-39850","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:yiisoft/yii2","fromFixed":"2.0.52","toFixed":"2.0.55","daysApart":405}]}},{"cve":"CVE-2026-39850","published":"2026-05-20","fixed":"2.0.55","kev":false}],"package":"Packagist:yiisoft/yii2"}}