p PatchFirst

CVE-2026-39850

CVE-2026-39850 · Yii 2: Local file inclusion via view parameter name collision

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled _file_ key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55.

CVSS 7.4 · Alta · EPSS 0,5% · Corrección disponible

Publicación
Actualización

Pila tecnológica: php

Productos y versiones afectados

  • yii2

    Versiones
    • < 2.0.55: Afectada

    Sin corrección publicada

  • yiisoft/yii2 Packagist

    Versiones
    • 2.0.0
    • 2.0.0-alpha
    • 2.0.0-beta
    • 2.0.0-rc
    • 2.0.1
    • 2.0.10
    • 2.0.11
    • 2.0.11.1
    • 2.0.11.2
    • 2.0.12
    • 2.0.12.1
    • 2.0.12.2
    • 2.0.13
    • 2.0.13.1
    • 2.0.13.2
    • 2.0.13.3
    • 2.0.14
    • 2.0.14.1
    • 2.0.14.2
    • 2.0.15
    • 2.0.15.1
    • 2.0.16
    • 2.0.16.1
    • 2.0.17
    • 2.0.18
    • 2.0.19
    • 2.0.2
    • 2.0.20
    • 2.0.21
    • 2.0.22
    • 2.0.23
    • 2.0.24
    • 2.0.25
    • 2.0.26
    • 2.0.27
    • 2.0.28
    • 2.0.29
    • 2.0.3
    • 2.0.30
    • 2.0.31
    • 2.0.32
    • 2.0.33
    • 2.0.34
    • 2.0.35
    • 2.0.36
    • 2.0.37
    • 2.0.38
    • 2.0.39
    • 2.0.39.1
    • 2.0.39.2
    • 2.0.39.3
    • 2.0.4
    • 2.0.40
    • 2.0.41
    • 2.0.41.1
    • 2.0.42
    • 2.0.42.1
    • 2.0.43
    • 2.0.44
    • 2.0.45
    • 2.0.46
    • 2.0.47
    • 2.0.48
    • 2.0.48.1
    • 2.0.49
    • 2.0.49.1
    • 2.0.49.2
    • 2.0.49.3
    • 2.0.49.4
    • 2.0.5
    • 2.0.50
    • 2.0.51
    • 2.0.52
    • 2.0.53
    • 2.0.54
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.0.9
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.0.55

    Actualiza a 2.0.55

Fuentes originales

Comprueba tu servidor →