CVE-2026-50547: Php Dynamic Php File Inclusion Unvalidated Identifiercve-2026-50547-php-dynamic-php-file-inclusion-unvalidated-identifier
A PHP script is included/required through a path concatenated around a variable identifier (base-dir . identifier . '.php') without validating that identifier against an anchored allowlist. If the identifier can contain '/', '\', '..' or other path metacharacters, an attacker can traverse out of the intended directory and include any existing local .php file
