CVE-2026-97150: Php Include Require Of Dynamic Untrusted File Pathcve-2026-97150-php-include-require-of-dynamic-untrusted-file-path
This include/require executes a file addressed by a non-constant expression ($PATH). If $PATH is derived from user-supplied input (e.g. the name or path of an uploaded/extraction-directory file such as config.php from an uploaded addon ZIP), an attacker who controls the file or its path gets arbitrary PHP code executed inside the application (untrusted code
