7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39850

CVE-2026-39850: Yii 2: Local file inclusion via view parameter name collision

The core view rendering method View::renderPhpFile() calls extract($_params_, EXTR_OVERWRITE) before the require statement that includes the view file. A caller-controlled parameter named _file_ in the $params array overwrites the internal local variable that specifies which file is included — enabling a Local File Inclusion primitive.

Impact

Local File Inclusion (arbitrary file read via non-PHP files)
Potential RCE if attacker can write PHP files via a separate primitive
Information disclosure

Patches

2.0.55

Workarounds

No.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39850

CVE-2026-39850:

7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
yiisoft/yii2	composer	< 2.0.55	2.0.55

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-5vpg-rj7q-qpw2, is a local file inclusion in the Yii2 framework. The root cause is the unsafe use of the extract() function with the EXTR_OVERWRITE flag in two core methods: yii\base\View::renderPhpFile() and yii\web\ErrorHandler::renderFile(). In both functions, user-supplied parameters ($_params_) are passed to extract(). If an attacker provides a parameter with the key _file_, it overwrites the internal $_file_ variable which holds the path to the view or error file to be rendered. Subsequently, when the require statement is executed with this attacker-controlled path, it leads to the inclusion and potential disclosure of arbitrary files on the local filesystem. The patch mitigates this by encapsulating the extract() and require calls within an anonymous function (a closure), creating a separate variable scope. The original file path and parameters are passed as arguments to this closure, ensuring that the extract() call within the closure cannot modify the variables in the parent function's scope. The analysis of the commit 109878b491dbffa541032bc99fb5e26d12cd0375 clearly shows these changes in framework/base/View.php and framework/web/ErrorHandler.php, confirming that View::renderPhpFile and ErrorHandler::renderFile are the vulnerable functions.

Vulnerable functions

View::renderPhpFile

framework/base/View.php

This function was vulnerable to local file inclusion. It used `extract($_params_, EXTR_OVERWRITE)` on user-supplied parameters. An attacker could provide a parameter named `_file_` in the `$_params_` array, which would overwrite the internal `$_file_` variable that specifies the path of the file to be rendered. This allowed an attacker to include and view arbitrary files from the local system.

ErrorHandler::renderFile

framework/web/ErrorHandler.php

This function had the same vulnerability as `View::renderPhpFile`. When rendering an error page, it used `extract($_params_, EXTR_OVERWRITE)` on parameters that could be influenced by the user. By crafting a request that triggered an error and passing a `_file_` parameter, an attacker could control the file path used in the `require` statement, leading to local file inclusion.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.