GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-41228: Php Lfi Sprintf Path Require No Traversal Guardcve-2026-41228-php-lfi-sprintf-path-require-no-traversal-guard

Function parameter '$ISO' is used in sprintf() to construct a file path for require/include without path traversal validation. An attacker controlling '$ISO' can inject '../' sequences to include arbitrary files outside the intended directory, potentially achieving Remote Code Execution (CWE-98 / PHP Local File Inclusion). Add a traversal guard before constr

PHPCVE-2026-41228CWE-98
by Provallyupdated 2026-06-12Apache-2.0
3.6K0 direct3.6K via packs
77
All matching rules loaded.