Yii 2, a PHP application framework, contains a flaw in View::renderPhpFile() where user‑controlled parameters are extracted with EXTR_OVERWRITE before the view file is required. A caller can supply a _file key within the $params array to overwrite the internal variable that designates which file to include. If an attacker can also place a PHP file that the application will read, this flaw can lead to Remote Code Execution; otherwise it can reveal sensitive files. The vulnerability is rated CWE‑20 and CWE‑98 and was fixed in Yii 2 version 2.0.55.

The Yii 2 framework from yiisoft is affected. Versions 2.0.54 and earlier are vulnerable. Version 2.0.55 and later contain the fix.

The CVSS score is 7.4, indicating a high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting exploitation is not yet widely observed. The likely attack vector is via a web request that can manipulate the $params array; if an attacker can write a PHP file into the application’s view directory, the flaw could be leveraged for RCE. Proper input validation or restricting the _file parameter can mitigate the risk until a patch is applied.