High severityPHPFile InclusionHIGH confidence

File Inclusion Lfi Rfi

Untrusted request input flows into include/require, allowing local or remote file inclusion (CWE-98).

Standards mapping

CWE: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
OWASP Top 10: A03:2021 - Injection
OWASP ASVS: V12.3.2 (L1)

Vulnerable vs. safe

Flagged by this check

include($page);

Passes - the safe pattern

include($page);

Why it matters & how to fix it

Untrusted request input flows into include/require, allowing local or remote file inclusion (CWE-98). An attacker can execute arbitrary PHP by controlling the included path (LFI via php://, data://, or log poisoning; RFI if allow_url_include is on). Never build an include path from request data — map user input to a fixed allow-list of file names with basename() validation.

References

Rule ID integsec-php-file-inclusion-lfi-rfi - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks