Local File Inclusion (LFI)

Also Known As

TL;DR

Explanation

LFI is a specific form of path traversal where the attacker causes the application to include a local file using PHP's include, require, include_once, or require_once. If the attacker can write a file to the server (e.g. via file upload), they can then include it and achieve remote code execution. Even without write access, LFI can expose /etc/passwd, application config files, and session data.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Using user-supplied language or template parameters directly in include() without a strict whitelist.
• Path traversal filtering that only strips ../ but misses URL-encoded or double-encoded variants.
• PHP wrappers like php://filter and php://input being usable even when URL include is disabled.
• Not using open_basedir to restrict which directories PHP can access at runtime.

Code Examples

\$page = \$_GET['page'];
include "pages/\$page.php"; // LFI: ?page=../../../../etc/passwd%00

// Allowlist — only permit known page names
\$allowed = ['home', 'about', 'contact', 'faq'];
\$page    = \$_GET['page'] ?? 'home';

if (!in_array(\$page, \$allowed, true)) {
    \$page = 'home';
}

include "pages/{\$page}.php"; // only pages in the allowlist

References

• ↗ https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
• ↗ https://cwe.mitre.org/data/definitions/98.html

Tags

Related Terms