Is CVE-2026-39850 actively exploited?

No active exploitation of CVE-2026-39850 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-39850 be exploited remotely?

Yes. CVE-2026-39850 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-39850?

CVE-2026-39850 has a CVSS score of 7.4 (HIGH).

HOME VULNERABILITIESCVE-2026-39850

HIGH

CVE-2026-39850

CWE-20Published: May 20, 2026· Updated: Jun 17, 2026

7.4

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:3.7th

Official Description

Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled _file_ key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55.

NVD Source

Technical Analysis

CVE-2026-39850 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 7.4.