CVE-2026-97150: Php Include Require Of Dynamic Untrusted File Path
This include/require executes a file addressed by a non-constant expression ($PATH). If $PATH is derived from user-supplied input (e.g. the name or path of an uploaded/extraction-directory file such as config.php from an uploaded addon ZIP), an attacker who controls the file or its path gets arbitrary PHP code executed inside the application (untrusted code
PHPgreprules fetch cve-2026-97150-php-include-require-of-dynamic-untrusted-file-path --engine opengrepDescription
This include/require executes a file addressed by a non-constant expression ($PATH). If $PATH is derived from user-supplied input (e.g. the name or path of an uploaded/extraction-directory file such as config.php from an uploaded addon ZIP), an attacker who controls the file or its path gets arbitrary PHP code executed inside the application (untrusted code
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.