What is the CVSS score of CVE-2026-39850?

CVE-2026-39850 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Yii2 are affected by CVE-2026-39850?

The Yii2 PHP framework versions prior to 2.0.55 contain a Local File Inclusion vulnerability that allows remote attackers to read arbitrary files on web servers, with potential for code execution if…. A patch is available.

How to fix or mitigate CVE-2026-39850?

Within 24 hours, identify all systems running Yii2 and confirm their current versions to prioritize remediation. Within 7 days, upgrade all affected Yii2 installations to version 2.0.55 or later, starting with production systems and staging environments. Within 30 days, audit systems that operated during the vulnerability window by reviewing access logs and file modification timestamps to determine if exploitation occurred, and implement input validation controls to restrict suspicious parameter usage.

Yii2 CVE-2026-39850

EUVD-2026-31190 HIGH

Improper Input Validation (CWE-20)

2026-05-11 https://github.com/yiisoft/yii2

GHSA-5vpg-rj7q-qpw2

PHP Information Disclosure

7.4

CVSS 3.1 · Vendor: https://github.com/yiisoft/yii2

Severity by source

Vendor (https://github.com/yiisoft/yii2) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N) but depends on a non-default app pattern passing user-controlled param keys (AC:H); guaranteed impact is arbitrary file read (C:H), with only conditional integrity impact via includable PHP (I:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/yiisoft/yii2).

CVSS VectorVendor: https://github.com/yiisoft/yii2

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:53 vuln.today

Analysis Generated

Jul 23, 2026 - 23:53 vuln.today

CVE Published

May 11, 2026 - 19:34 nvd

HIGH 7.4

DescriptionCVE.org

The core view rendering method View::renderPhpFile() calls extract($_params_, EXTR_OVERWRITE) before the require statement that includes the view file. A caller-controlled parameter named _file_ in the $params array overwrites the internal local variable that specifies which file is included - enabling a Local File Inclusion primitive.

Impact

Local File Inclusion (arbitrary file read via non-PHP files)
Potential RCE if attacker can write PHP files via a separate primitive
Information disclosure

Patches

2.0.55

Workarounds

No.

AnalysisAI

Local File Inclusion in the Yii2 PHP framework (all versions before 2.0.55) allows remote attackers to read arbitrary local files by supplying a request parameter named _file_ that collides with an internal variable in View::renderPhpFile() and ErrorHandler::renderFile(). Because the render routine runs extract($_params_, EXTR_OVERWRITE) before require $_file_, an attacker-controlled _file_ key overwrites the path of the file to be included, yielding arbitrary file read and, if a PHP file is includable, potential code execution. No public exploit identified at time of analysis; EPSS is very low (0.05%, 14th percentile) and CISA SSVC records no observed exploitation, though the technical impact is rated total.

Technical ContextAI

Yii2 is a mature, widely-used PHP MVC web framework (package pkg:composer/yiisoft/yii2). The flaw is a variable/parameter name-collision in the view layer: PHP's extract() with the EXTR_OVERWRITE flag imports every key of the caller-supplied $_params_ array into the current local scope, overwriting existing locals. Since the internal local variable holding the include target is literally named $_file_, any params entry keyed _file_ (and in the ErrorHandler path, _file_ resolved via Yii::getAlias()) silently replaces the intended view path before require executes. This maps to CWE-20 (Improper Input Validation) - the framework trusts caller-provided parameter names without isolating internal control variables. The upstream fix (commit 109878b) wraps the extract+require in a closure invoked via call_user_func_array, so func_get_arg(0)/func_get_arg(1) hold the file path and params in an isolated scope that user keys can no longer overwrite; the same hardening is applied to both View.php and web/ErrorHandler.php, with regression tests asserting a _file_ param cannot override the rendered file.

RemediationAI

Vendor-released patch: 2.0.55 - upgrade via composer require yiisoft/yii2:^2.0.55 (or composer update yiisoft/yii2) to the fixed release at https://github.com/yiisoft/yii2/releases/tag/2.0.55; the code fix is commit https://github.com/yiisoft/yii2/commit/109878b491dbffa541032bc99fb5e26d12cd0375. The vendor explicitly states there are no supported workarounds, so patching is the required action. As an interim compensating control until you can upgrade, audit application code that calls render/renderFile/renderPhpFile and ensure no user-supplied array keys ever reach the $params argument - specifically strip or whitelist parameter names and reject or unset any incoming key named _file_ (and _params_) before passing data to view rendering; the trade-off is that this is application-specific and easy to miss across a large codebase, which is why the upstream scope-isolation fix is preferred. Refer to the advisory at https://github.com/yiisoft/yii2/security/advisories/GHSA-5vpg-rj7q-qpw2 for details.