Yii2 allows attackers to execute any local .php file via a relative path in the view parameter

published 2023-09-21 3 y ago modified 2026-06-17 4 mo ago also GHSA-7cfq-72w2-24q4 , EUVD-2023-2454

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.

Patch / fix

fixed in 2

packagist yiisoft/yii2 2.0.5
yiiframework yii 2.0.5

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 2 y ago (2024-09-25)

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
packagist	yiisoft/yii2	>=2.0.0, <2.0.5	2.0.5

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program

References

yiiframework.com /news/87/yii-2-0-5-is-released-security-fix
web, release-notes
github.com /FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2-dev/CVE-2015-5467.yaml
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2015-5467
advisory
github.com /FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2015-5467.yaml
web
github.com /yiisoft/yii2-framework
package

Sources

CVE List CVE-2015-5467
GitHub Advisory GHSA-7cfq-72w2-24q4
NVD CVE-2015-5467

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary