CVE-2026-39850

HighCVSS 7.4

Published: 20/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

36th percentile - higher than 36% of all known CVEs

Summary

Local File Inclusion (LFI) vulnerability in Yii 2 (versions up to 2.0.54). The View::renderPhpFile() function overwrites the internal _file_ variable via extract(), allowing arbitrary file inclusion, potentially leading to RCE or information disclosure.

Risk Assessment

An attacker can read sensitive server files or, if able to write PHP files, achieve remote code execution, leading to full server compromise.

Recommendation

Upgrade Yii 2 to version 2.0.55 or later. Avoid passing the '_file' parameter in the $params array to views.

Other vulnerabilities in Yii 2

CVE-2024-58136CriticalActively exploited
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

Original NVD description (English source)

Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled _file_ key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS