PT-2026-39402 · Unknown · Yii Framework

Khuroohamid · Published 2026-05-09 · Updated 2026-05-20 · CVE-2026-39850

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Yii Framework versions prior to 2.0.55

Description Internal variables in the View::renderPhpFile() and ErrorHandler::renderFile() functions are not isolated, which can lead to parameter collisions that allow the overriding of included file paths.

Recommendations Update to version 2.0.55.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-98

Related Identifiers

CVE-2026-39850

GHSA-5VPG-RJ7Q-QPW2

Affected Products

Yii Framework

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-39850 · Security Note
• https://osv.dev/vulnerability/GHSA-5vpg-rj7q-qpw2 · Vendor Advisory
• https://github.com/yiisoft/yii2 · Note
• https://github.com/yiisoft/yii2/commit/109878b491dbffa541032bc99fb5e26d12cd0375 · Note
• https://github.com/yiisoft/yii2/releases/tag/2.0.55 · Note
• https://github.com/yiisoft/yii2/security/advisories/GHSA-5vpg-rj7q-qpw2 · Note
• https://reddit.com/r/PHP/comments/1t88bz1/yii2_2055_released_with_security_fix_for · Reddit Post
• https://twitter.com/Terabytesoftw/status/2053133870103412974 · Twitter Post