Khuroohamid

**Name of the Vulnerable Software and Affected Versions** Yii 2 versions prior to 2.0.55 **Description** Flawed logic in the core view rendering method `View::renderPhpFile()` leads to Local File Inclusion. The function executes `extract($ params , EXTR OVERWRITE)` before the `require` statement used to load the view file. Consequently, a caller-controlled ` file ` key within the `$params` array can overwrite the internal local variable that determines which file is included. This can result in information disclosure or Remote Code Execution (RCE) if an attacker can write PHP files to the system through a separate primitive. **Recommendations** Update to version 2.0.55.