yiisoft/yii2 security advisory

CVE-2026-39850: Yii 2: Local file inclusion via view parameter name collision

CVE-2026-39850 is a high-severity file inclusion vulnerability in the PHP package yiisoft/yii2 (CVSS 7.4), published 20 May 2026. It is fixed in 2.0.55; earlier versions are affected. It can be exploited without an account.

high 7.4 published 2026-05-20 · updated 2026-07-23

Affected versions: < 2.0.55
Fixed in: 2.0.55
Newest release: 2.0.55
Severity: High · CVSS 7.4
Type: File inclusion
CWE-20, CWE-98
Exploited in the wild: Not on the CISA KEV list
checked 2026-11-04

Is your yiisoft/yii2 version affected?

Run composer show yiisoft/yii2 in your project, then enter the version. We check it against this and every other known yiisoft/yii2 advisory.

Who can exploit CVE-2026-39850

Access: No account. Anyone who can send a request to an app that uses the affected code.
Conditions: It only works under specific conditions the attacker does not fully control (CVSS rates the attack as high complexity).

CVSS vector (scored by GitHub): CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Your app is only exposed if it uses the affected part of yiisoft/yii2. The advisory below says which part that is. If you are not sure, upgrade anyway: it costs less than finding out.

How to fix CVE-2026-39850 in yiisoft/yii2

Find the installed version: composer show yiisoft/yii2. If you never required it yourself, composer why yiisoft/yii2 shows which package pulls it in.
Update it: composer update yiisoft/yii2 --with-all-dependencies. You need 2.0.55 or newer.
If Composer will not go that high, your composer.json constraint is holding it back. Widen it (for example "yiisoft/yii2": "^2.0.55" if you can take that version), or upgrade the package that requires it.
Run composer audit. It reads the same advisory data and should no longer list CVE-2026-39850.
Commit composer.lock and deploy it. On the server, run composer install --no-dev from the lock file, not composer update.

If you cannot upgrade yet

General hardening for file inclusion issues while the upgrade waits. None of it replaces the fix.

Validate file names against an allow-list and reject paths containing ../ or absolute paths.
If your app does not use the affected feature, note that in your audit, but still plan the upgrade.

The CVE-2026-39850 advisory

Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled _file_ key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55.

Description from the CVE record, published by GitHub (the CVE Numbering Authority), via the NVD entry for CVE-2026-39850. Advisory title: “Yii 2: Local file inclusion via view parameter name collision”.

References

GitHub advisory GHSA-5vpg-rj7q-qpw2 github.com
Fix commit 109878b github.com

Other yiisoft/yii2 advisories

critical CVE-2024-58136: Yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a __class Array Key 2025-04-10
high CVE-2024-4990: Unsafe Reflection in base Component class 2024-06-04
medium CVE-2024-32877: Reflected Cross-site Scripting in yiisoft/yii2 Debug mode 2024-06-02
medium CVE-2017-7271: Yii Framework Reflected XSS 2022-05-17
medium CVE-2017-11516: Yii Cross-site Scripting Framework vulnerability 2022-05-17
medium CVE-2018-20745: Yii Incorrectly Implements CORS 2022-05-14

Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.

Ask about a fix

Where this data comes from

Affected and fixed versions: the Packagist security advisories API (GitHub Advisory Database and FriendsOfPHP), the same data composer audit uses. Synced 2026-11-03.
Description, score, weakness and references: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Exploited-in-the-wild status: the CISA Known Exploited Vulnerabilities catalog, checked 2026-11-04.
Compiled by Daniel Lasek at Laskyr from the sources above. The summary, “who can exploit it”, “how to fix it” and hardening sections are our plain-English reading of the record and are generated from it. The quoted description is the record's own text. Spot an error? Tell us.