Threats affecting pkg:composer/yiisoft/yii2

Yii 2 versions 2.0.54 and earlier contain a vulnerability in the core view rendering method View::renderPhpFile() that allows local file inclusion due to improper input validation. This occurs because the function uses extract($_params_, EXTR_OVERWRITE) before including the view file, enabling an attacker to overwrite the internal variable specifying the file to include via a specially crafted _file_ key in the parameters array. This flaw can lead to remote code execution if an attacker can write PHP files through another vulnerability, as well as information disclosure. The issue is fixed in version 2.0.55.