CVE-2026-39850: 
Yii vulnerability analysis and mitigation

CVE-2026-39850 is a Local File Inclusion (LFI) vulnerability in the Yii 2 PHP application framework, specifically in the View::renderPhpFile() method, caused by a view parameter name collision. It affects all versions of yiisoft/yii2 prior to 2.0.55. The vulnerability was published on May 9, 2026, with the GitHub Advisory (GHSA-5vpg-rj7q-qpw2) published May 11, 2026, and NVD publication on May 20, 2026. It carries a CVSS v3.1 base score of 7.4 (High) (Github Advisory, Yii Security Advisory).

The root cause is flawed logic in View::renderPhpFile() (CWE-20, CWE-98): the method calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. Because EXTR_OVERWRITE is used, a caller-supplied parameter named _file_ in the $params array will overwrite the internal $_file_ variable that controls which file is included via require. This allows an attacker who can influence the $params array passed to renderPhpFile() to redirect the file inclusion to an arbitrary path on the server. The same flaw was also present in ErrorHandler::renderFile(). The fix, committed in patch commit, wraps the extract and require calls inside a closure using func_get_arg() to isolate internal variables from caller-supplied parameters, preventing any collision (Github Advisory, Yii Security Advisory).

Successful exploitation enables Local File Inclusion, allowing an unauthenticated remote attacker to read arbitrary files on the server (e.g., configuration files, credentials, or other sensitive data). If an attacker can also write PHP files to the filesystem through a separate vulnerability or misconfiguration (such as an unrestricted file upload), the LFI primitive can be chained to achieve Remote Code Execution (RCE). Availability is not directly impacted, but confidentiality and integrity are both rated High due to the potential for sensitive data exposure and code execution (Github Advisory, Yii Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.022% (6th percentile), indicating a low near-term probability of exploitation. Exploitation requires high attack complexity, as the attacker must be able to influence the $params array passed to renderPhpFile(), and RCE additionally requires a separate file-write primitive (Github Advisory).

1. Identify target: Locate a Yii 2 application running version 2.0.54 or earlier that exposes functionality where user-controlled data is passed as parameters to View::renderPhpFile() or ErrorHandler::renderFile().
2. Craft malicious parameter: Construct a request or input that includes a parameter named _file_ with a value pointing to a sensitive server-side file (e.g., /etc/passwd, application config files, or .env files).
3. Trigger LFI: Submit the crafted input through the application's normal request flow so that the _file_ parameter reaches renderPhpFile() as part of the $params array. The extract($_params_, EXTR_OVERWRITE) call overwrites the internal $_file_ variable, causing require to load the attacker-specified file.
4. Read arbitrary files: The contents of the targeted file are rendered as part of the view output and returned to the attacker, enabling information disclosure.
5. Escalate to RCE (if applicable): If a separate file-write primitive exists (e.g., unrestricted file upload), upload a PHP webshell to a known path, then use the LFI to include and execute it via the same _file_ parameter override (Github Advisory, Yii Security Advisory).

• Logs: Application or web server access logs showing requests with parameters named _file_ pointing to paths outside the normal view directory (e.g., /etc/passwd, .env, or uploaded file directories).
• Logs: PHP error logs or application logs showing unexpected file inclusion paths in View::renderPhpFile() or ErrorHandler::renderFile().
• File System: Presence of newly uploaded PHP files in directories accessible by the web server (potential indicator of a chained RCE attempt).
• Network: Unusual outbound connections from the web server process following requests containing _file_ parameters (may indicate successful RCE via chained file upload).
• Process: Unexpected child processes spawned by the PHP-FPM or web server process (e.g., sh, bash, curl, wget) following suspicious requests (Github Advisory).

Upgrade yiisoft/yii2 to version 2.0.55 or later, which isolates internal variables in View::renderPhpFile() and ErrorHandler::renderFile() using a closure to prevent parameter name collisions. No workarounds are available; patching is the only mitigation. The fix is available via Composer (composer update yiisoft/yii2) or from the GitHub release (Github Advisory, Patch Commit).

The Yii framework team published an official release announcement for version 2.0.55 addressing this vulnerability (Yii Framework News). The issue was discussed on Reddit's r/PHP community shortly after the release (Reddit r/PHP). The vulnerability was reported by researcher khuroohamid and credited in the official advisory (Yii Security Advisory). Overall community reaction appears measured, reflecting the moderate exploitability requirements and absence of public PoC or active exploitation.