CVE-2026-90937: Php Unvalidated Param File Inclusioncve-2026-90937-php-unvalidated-param-file-inclusion
A file path is dynamically constructed using an unvalidated function parameter and passed to a require or include statement. Without validating the parameter against an allowlist or ensuring it contains no path traversal sequences (such as via basename() or checking for '..'), an attacker may perform local file inclusion.
