-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| yiisoft/yii2 | composer | >= 2.0.0, < 2.0.5 | 2.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from ViewAction's handling of the 'view' parameter. The resolveViewName method (called internally by ViewAction) was vulnerable because it: 1. Accepted relative paths through the view parameter 2. Only checked that the file ends with .php extension 3. Failed to properly verify the resolved path remains within allowed directories. This allowed attackers to use path traversal sequences to access PHP files outside intended view directories. The fix in 2.0.5 added proper path normalization and verification using realpath() and directory containment checks.