{"id":"GHSA-7cfq-72w2-24q4","aliases":["CVE-2015-5467"],"title":"Yii2 allows attackers to execute any local .php file via a relative path in the view parameter","description":"web\\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.","severity":"critical","score":9.8,"published":"2023-09-21T06:30:25.000Z","modified":"2024-02-16T08:09:48.377Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"yiisoft/yii2","ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"],"fixed":["2.0.5"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2015-5467","https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2-dev/CVE-2015-5467.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2015-5467.yaml","https://github.com/yiisoft/yii2-framework","https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix"],"sources":[{"name":"OSV","id":"GHSA-7cfq-72w2-24q4","modified":"2024-02-16T08:09:48.377713Z","url":"https://osv.dev/vulnerability/GHSA-7cfq-72w2-24q4"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"evidence":[]}