File Inclusion Injection (ARCH7139)

Key php.security.file-inclusion-injection · Severity critical · Category security · CWE CWE-98

When an include/require path comes from user input it enables local/remote file inclusion (LFI/RFI). An attacker can execute arbitrary PHP files and achieve RCE.

Incorrect

<?php
$page = $_GET['page'];
include $page . '.php'; // ../../etc/passwd, http://evil/shell

Correct

<?php
$pages = ['home' => 'home.php', 'about' => 'about.php'];
$page = $_GET['page'] ?? 'home';
if (isset($pages[$page])) {
    include __DIR__ . '/views/' . $pages[$page];
}

Fix

Map the file to include against a fixed allowlist; never build the path directly from user input.