CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Description
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-98 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-f8ff-652m-j5rx | CVE-2026-62858 | MODERATE | - |
YOURLS: Unauthenticated File Inclusion |
2026-10-15 |
| GHSA-6r9h-4h75-7q4x | CVE-2026-9559 | CRITICAL | - |
Mautic vulnerable to Path Traversal via Campaign Import |
2026-07-02 |
| GHSA-5vpg-rj7q-qpw2 | CVE-2026-39850 | HIGH | - |
Yii 2: Local file inclusion via view parameter name collision |
2026-06-08 |
| GHSA-9hx7-c53c-v6x8 | CVE-2026-44177 | HIGH | - |
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup |
2026-05-26 |
| GHSA-w59f-67xm-rxx7 | CVE-2026-41228 | CRITICAL | - |
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution |
2026-04-24 |
| GHSA-2mfj-r695-5h9r | CVE-2026-34036 | MODERATE | - |
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php |
2026-03-31 |
| GHSA-8fw8-q79c-fp9m | CVE-2026-33513 | HIGH | - |
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) |
2026-03-25 |
| GHSA-49xw-hw94-fmv2 | - | HIGH | - |
Dolibarr has Remote Code Execution Vulnerability (Bypass) |
2025-12-18 |
| GHSA-g2j9-g8r5-rg82 | CVE-2025-64714 | MODERATE | - |
PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal |
2025-11-14 |
| GHSA-gq96-8w38-hhj2 | CVE-2025-54138 | HIGH | - |
LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE |
2025-07-23 |
| GHSA-j3f9-p6hm-5w6q | CVE-2025-22145 | MODERATE | - |
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale |
2025-02-25 |
| GHSA-45c3-c4c3-8rqg | CVE-2023-31716 | HIGH |
FUXA vulnerable to Local File Inclusion |
2024-09-25 | |
| GHSA-wwfj-h843-3hrq | CVE-2023-31718 | HIGH |
FUXA local file inclusion vulnerability |
2023-09-25 | |
| GHSA-7cfq-72w2-24q4 | CVE-2015-5467 | CRITICAL | - |
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter |
2023-09-25 |
| GHSA-67c6-q4j4-hccg | CVE-2023-40033 | HIGH | - |
Flarum vulnerable to LFI and Blind SSRF via Avatar upload |
2023-08-16 |
| GHSA-xcq3-7pf3-5jvc | CVE-2023-4195 | CRITICAL | - |
Cockpit PHP Remote File Inclusion vulnerability |
2023-08-09 |
| GHSA-g3p2-hfqr-9m25 | CVE-2021-22968 | HIGH | - |
Improper file handling in concrete5/core |
2023-06-30 |
| GHSA-r23f-c2j5-rx2f | CVE-2020-5295 | MODERATE | - |
Local File read vulnerability in OctoberCMS |
2021-03-04 |