{
  "ticket_id": "CVE-2026-39850",
  "code_root": "external/yii2",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-39850",
    "advisory_id": "GHSA-5vpg-rj7q-qpw2",
    "advisory_url": "https://github.com/yiisoft/yii2/security/advisories/GHSA-5vpg-rj7q-qpw2",
    "vendor": "yiisoft",
    "product": "yii2",
    "repo": "https://github.com/yiisoft/yii2"
  },
  "facts": {
    "cve_id": "CVE-2026-39850",
    "advisory_id": "GHSA-5vpg-rj7q-qpw2",
    "issue_summary": "View::renderPhpFile($_file_, $_params_) calls extract($_params_, EXTR_OVERWRITE) before the require $_file_. A caller-controlled `_file_` key in the params array overwrites the local $_file_ variable before the require, redirecting the include to any path on disk — local file inclusion (and PHP code execution if the included file is PHP).",
    "vulnerability_type": "Local File Inclusion / Code Injection",
    "suspected_cwe": ["CWE-98", "CWE-94"],
    "affected_versions": "<= 2.0.54",
    "fixed_versions": ["2.0.55"],
    "reproduce_version": "2.0.54",
    "verify_fixed_version": "2.0.55",
    "repo_url": "https://github.com/yiisoft/yii2.git",
    "fix_commit": "109878b491dbffa541032bc99fb5e26d12cd0375",
    "code_root": "external/yii2",
    "ecosystem": "packagist",
    "package": "yiisoft/yii2",
    "affected_functions": ["yii\\web\\View::renderPhpFile", "yii\\base\\View::renderPhpFile"],
    "install_recipe": "In a scratch composer project run `composer require yiisoft/yii2:2.0.54` (vulnerable) or `composer require yiisoft/yii2:2.0.55` (fixed). The Packagist release is the canonical artifact; git tags 2.0.54 / 2.0.55 on the repo are equivalent.",
    "attacker_access": "Any code path that forwards an attacker-influenced array as the $params argument of View::renderPhpFile (e.g. a request body decoded straight into render params).",
    "primary_entry_point": "yii\\web\\View::renderPhpFile($safeFile, $attackerParams) where $attackerParams contains a '_file_' key",
    "exploit_outline": "Write a small PHP script that instantiates `yii\\web\\View` and calls `$view->renderPhpFile('safe.php', ['_file_' => '/etc/passwd'])`. The extract() overwrites $_file_ before the require, so /etc/passwd is included instead of safe.php.",
    "vulnerable_indicator": "Script output is the contents of /etc/passwd (the attacker-chosen file was included).",
    "fixed_indicator": "Script output is the contents of safe.php (the local $_file_ is no longer clobberable by the params array).",
    "reproduction_requirements": "PHP (a maintained version supported by Yii2) and Composer. No web server, database, or browser required - the difference is observable from a single PHP CLI invocation.",
    "notes": "The fix commit 109878b491dbffa541032bc99fb5e26d12cd0375 changes how renderPhpFile imports params so the local $_file_ cannot be overwritten by the params array."
  }
}