open_basedir Restriction

Also Known As

TL;DR

Explanation

open_basedir limits PHP's file functions (fopen, file_get_contents, include, require, etc.) to files within the specified path prefix. An attacker who achieves LFI or path traversal is then confined to the permitted directory and cannot read /etc/passwd or other sensitive files outside the web root. Set it to the application directory and any required upload/temp paths: open_basedir = /var/www/html:/tmp. Note that open_basedir is a defence-in-depth measure — it does not replace input validation, and some bypass techniques exist on misconfigured servers.

Common Misconception

Why It Matters

Common Mistakes

• Not configuring open_basedir in production — a path traversal vulnerability can then read any world-readable file.
• Setting open_basedir to / (root) which is equivalent to disabling it.
• Including /tmp in open_basedir without realising session files, uploads, and shell upload targets may be in /tmp.
• Not testing that open_basedir restrictions survive php.ini overrides in user .htaccess files.

Code Examples

# php.ini — open_basedir not configured:
; open_basedir =  (commented out — no restriction)
; Attacker can read: include '../../../../etc/passwd';

; php.ini — restrict PHP filesystem access to specified paths
open_basedir = /var/www/app:/tmp
; PHP raises an error if it tries to access files outside these dirs
; Mitigates path traversal and LFI impact significantly

; Per virtual host (overrides global):
; fastcgi_param PHP_VALUE "open_basedir=/var/www/site1:/tmp";

; PHP code — detect if restriction is active:
if (ini_get('open_basedir')) {
    // Filesystem is restricted
}

; Note: not a security boundary for determined attackers with code execution
; but raises the bar significantly for exploitation
; Combine with: chroot jails, seccomp, read-only mounts

References

• ↗ https://www.php.net/manual/en/ini.core.php#ini.open-basedir
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/PHP_Configuration_Cheat_Sheet.html

Tags

Related Terms