CVE-2026-90767: Php Unvalidated File Inclusion Path Traversalcve-2026-90767-php-unvalidated-file-inclusion-path-traversal
A file path is constructed from an unvalidated function parameter and included using require or include without checking for directory traversal sequences. This may allow local file inclusion (LFI) or path traversal. Validate the input against an allowed list or verify that it contains no path traversal sequences (e.g., using basename() or checking for '..')
