Yii2 allows attackers to execute any local .php file via a relative path in the view parameter

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2015-5467 · ADVISORY
• FriendsOfPHP/security-advisories · WEB
• FriendsOfPHP/security-advisories · WEB
• yiisoft/yii2-framework · PACKAGE
• yiiframework.com/news/87/yii-2-0-5-is-released-security-fix · WEB

yiisoft/yii2 のその他の脆弱性

• CVE-2026-39850高 7.4Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile()…
• CVE-2024-58136緊急 9.8悪用確認済み（CISA KEV）Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited i…
• CVE-2024-4990緊急 9.1In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that th…
• CVE-2024-32877中 4.7Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scriptin…
• CVE-2023-26750緊急 9.8SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code vi…