Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
This include/require executes a file addressed by a non-constant expression ($PATH). If $PATH is derived from user-supplied input (e.g. the name or path of an uploaded/extraction-directory file such as config.php from an uploaded addon ZIP), an attacker who controls the file or its path gets arbitrary PHP code executed inside the application (untrusted code
A file path is dynamically constructed using an unvalidated function parameter and passed to a require or include statement. Without validating the parameter against an allowlist or ensuring it contains no path traversal sequences (such as via basename() or checking for '..'), an attacker may perform local file inclusion.
A file path is constructed from an unvalidated function parameter and included using require or include without checking for directory traversal sequences. This may allow local file inclusion (LFI) or path traversal. Validate the input against an allowed list or verify that it contains no path traversal sequences (e.g., using basename() or checking for '..')
Directly concatenating 'realpath()' with a directory separator without verifying that 'realpath()' did not return false creates an insecure base path prefix. If the path does not exist, 'realpath()' returns false, which coerces to '/' in string concatenation. Subsequent prefix checks with 'strpos()' or 'str_starts_with()' will match any absolute path startin
extract() with EXTR_OVERWRITE (or no flag, which defaults to EXTR_OVERWRITE) imports every key of the given array as a local variable and overwrites variables already defined in the enclosing scope, including function parameters. When the array's KEY SET is request-controlled (e.g. a wp_parse_args()-built array like $this->query_vars), an attacker can supply
A PHP script is included/required through a path concatenated around a variable identifier (base-dir . identifier . '.php') without validating that identifier against an anchored allowlist. If the identifier can contain '/', '\', '..' or other path metacharacters, an attacker can traverse out of the intended directory and include any existing local .php file
Function parameter '$ISO' is used in sprintf() to construct a file path for require/include without path traversal validation. An attacker controlling '$ISO' can inject '../' sequences to include arbitrary files outside the intended directory, potentially achieving Remote Code Execution (CWE-98 / PHP Local File Inclusion). Add a traversal guard before constr
A whitelist used for a security decision is derived by enumerating a directory that contains executable PHP code (views/templates/plugins/modules). Any PHP file an attacker can write into the scanned directory (admin file-write primitive, unsafe upload path, or permissive directory permissions) is automatically treated as "allowed"; once the validated name i
Calling `extract()` without `EXTR_SKIP` allows array elements to overwrite existing local scope variables. If the extracted array contains user input, an attacker can override critical variables such as file paths or template names, leading to Local File Inclusion or authentication bypass. Always pass `EXTR_SKIP` to `extract()`.
Calling `extract()` on an array parameter can implicitly overwrite local variables, including the path variable used in a subsequent file inclusion. An attacker controlling the extracted array can override the inclusion path and achieve Local File Inclusion (LFI) or Remote Code Execution (RCE). Consider explicitly assigning variables, extracting with `EXTR_S
Autoloader performs a namespace prefix check but includes the file outside of that condition, potentially allowing Local File Inclusion (LFI).
User-controlled HTTP input flows from an unvalidated Illuminate\Http\Request parameter into a Loader::load() call without allowlist validation. An attacker can supply path-traversal sequences (e.g. '../../../') in locale or namespace parameters to escape the translations directory and force inclusion of arbitrary PHP files, enabling unauthenticated remote co
Unvalidated HTTP request input flows through str_replace('.', '/') into a translation file loader (->load()). The dot-to-slash conversion transforms user-controlled dot-notation into filesystem path separators, creating a path-traversal primitive. When the loader resolves the constructed path and require()s the resulting PHP file, an attacker can achieve arb
