CVE-2026-39850: Yii 2 Local File Inclusion Vulnerability via Parameter Name Collision
Summary
CVE-2026-39850: Yii 2: Local file inclusion via view parameter name collision. Affects yiisoft/yii2 versions < 2.0.55. Fixed in 2.0.55. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yii 2 is a high-performance PHP framework designed for developing web applications. It provides a rich set of features, including MVC architecture, security measures, and database access. However, it is susceptible to vulnerabilities that can compromise the security of applications built using this framework. This specific vulnerability arises from the way the framework handles view rendering, particularly in the View::renderPhpFile() method.
Vulnerability Detail
The vulnerability occurs due to the use of the extract($_params_, EXTR_OVERWRITE) function in the View::renderPhpFile() method, which allows a caller-controlled parameter named _file_ to overwrite the internal variable that specifies the file to be included. This leads to Local File Inclusion (LFI), enabling attackers to read arbitrary files on the server. If an attacker can also write PHP files, this could potentially lead to Remote Code Execution (RCE), posing a significant risk of information disclosure and system compromise.
How To Fix
Minimum fixed version
2.0.55
This is the first release that contains the fix.
composer require yiisoft/yii2:2.0.55Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no workarounds available to mitigate this vulnerability other than updating to the patched version.
Conclusion
The CVE-2026-39850 vulnerability in Yii 2 poses a significant risk due to its potential for Local File Inclusion and possible Remote Code Execution. It is essential to update to version 2.0.55 or later to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for yiisoft/yii2 →
FAQ
Local File Inclusion (LFI) is a type of vulnerability that allows an attacker to include files on a server through the web browser. This can lead to unauthorized access to sensitive files.
If exploited, this vulnerability can allow attackers to read sensitive files from your server, potentially leading to information disclosure or even remote code execution if they can upload malicious files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your composer.lock file for vulnerabilities without requiring any signup.
If you cannot update the package immediately, it is crucial to monitor your application for any suspicious activity and consider implementing additional security measures to protect sensitive files.
The CVSS score of this vulnerability is 7.4, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2.
