{
  "ticket_id": "CVE-2026-39850",
  "source": "cve",
  "cve_id": "CVE-2026-39850",
  "advisory_id": "GHSA-5vpg-rj7q-qpw2",
  "html_url": "https://github.com/yiisoft/yii2/security/advisories/GHSA-5vpg-rj7q-qpw2",
  "references": [
    "https://github.com/yiisoft/yii2/security/advisories/GHSA-5vpg-rj7q-qpw2",
    "https://github.com/yiisoft/yii2",
    "https://github.com/yiisoft/yii2/commit/109878b491dbffa541032bc99fb5e26d12cd0375"
  ],
  "severity": "high",
  "cwe": ["CWE-98", "CWE-94"],
  "cvss": {
    "nvd_v3_1_base_score": 7.4
  },
  "labels": ["security", "lfi", "code-injection", "yii2", "php", "packagist"],
  "state": "published"
}