Skip to content
OpenAdvisories

Product · yiisoft

yii2

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    CVE-2026-39850

    Yii 2: Local file inclusion via view parameter name collision

    Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement…

    yiisoft yii2 yiisoft/yii2 Packagist
  • High 8.9
    CVE-2020-15148 Public exploit Scanner template EPSS 78%

    Unsafe deserialization in Yii 2

    Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

    yiisoft yii2 yiisoft/yii2 Packagist