CVE-2026-90937: Php Unvalidated Param File Inclusion
A file path is dynamically constructed using an unvalidated function parameter and passed to a require or include statement. Without validating the parameter against an allowlist or ensuring it contains no path traversal sequences (such as via basename() or checking for '..'), an attacker may perform local file inclusion.
PHPgreprules fetch cve-2026-90937-php-unvalidated-param-file-inclusion --engine opengrepDescription
A file path is dynamically constructed using an unvalidated function parameter and passed to a require or include statement. Without validating the parameter against an allowlist or ensuring it contains no path traversal sequences (such as via basename() or checking for '..'), an attacker may perform local file inclusion.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.