CVE-2026-39850

Name of the Vulnerable Software and Affected Versions Yii 2 versions prior to 2.0.55

Description Flawed logic in the core view rendering method View::renderPhpFile() leads to Local File Inclusion. The function executes extract($ params , EXTR OVERWRITE) before the require statement used to load the view file. Consequently, a caller-controlled file key within the $params array can overwrite the internal local variable that determines which file is included. This can result in information disclosure or Remote Code Execution (RCE) if an attacker can write PHP files to the system through a separate primitive.

Recommendations Update to version 2.0.55.