Local File Inclusion Flaw in Yii 2 Framework by Yiisoft

CVE-2026-39850

What is CVE-2026-39850?

The Yii 2 Framework, specifically in versions 2.0.54 and earlier, suffers from a Local File Inclusion vulnerability due to a flaw within the core view rendering method, View::renderPhpFile(). This flaw arises from improper handling of parameters, allowing an attacker to manipulate the internal file-path variable. If an attacker manages to control the file key in the $params array, they can potentially overwrite it to include arbitrary PHP files. This could lead to Remote Code Execution (RCE) if the attacker has another method to write PHP files on the server, as well as exposing sensitive information. The issue has been addressed in version 2.0.55.

References