High severityPHPInsecure ConfigurationHIGH confidence

Allow URL Include Fopen Enabled

allow_url_include / allow_url_fopen is being enabled at runtime (CWE-829/CWE-98).

Standards mapping

CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
OWASP Top 10: A05:2021 - Security Misconfiguration
OWASP ASVS: V14.3.2 (L1)

Vulnerable vs. safe

Flagged by this check

ini_set("allow_url_include", 1);

Passes - the safe pattern

ini_set("allow_url_include", 0);

Why it matters & how to fix it

allow_url_include / allow_url_fopen is being enabled at runtime (CWE-829/CWE-98). This lets include/require and file functions pull code and data from remote URLs, turning path bugs into remote file inclusion. Keep allow_url_include = Off and avoid enabling allow_url_fopen.

References

Rule ID integsec-php-allow-url-include-fopen-enabled - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks