CVE-2026-13765: Php Extract Lfi Overwrite
Calling `extract()` on an array parameter can implicitly overwrite local variables, including the path variable used in a subsequent file inclusion. An attacker controlling the extracted array can override the inclusion path and achieve Local File Inclusion (LFI) or Remote Code Execution (RCE). Consider explicitly assigning variables, extracting with `EXTR_S
PHPgreprules fetch cve-2026-13765-php-extract-lfi-overwrite --engine opengrepDescription
Calling `extract()` on an array parameter can implicitly overwrite local variables, including the path variable used in a subsequent file inclusion. An attacker controlling the extracted array can override the inclusion path and achieve Local File Inclusion (LFI) or Remote Code Execution (RCE). Consider explicitly assigning variables, extracting with `EXTR_S
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.