CVE-2026-17605: Php Unsafe Extract Overwritecve-2026-17605-php-unsafe-extract-overwrite
Calling `extract()` without `EXTR_SKIP` allows array elements to overwrite existing local scope variables. If the extracted array contains user input, an attacker can override critical variables such as file paths or template names, leading to Local File Inclusion or authentication bypass. Always pass `EXTR_SKIP` to `extract()`.
