CAPEC-251
Local Code Inclusion
The attacker forces an application to load arbitrary code files from the local machine. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-251: Local Code Inclusion: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/251.html and https://cve.bz/cve/capec/251?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The targeted application must have a bug that allows an adversary to control which code file is loaded at some juncture.
Some variants of this attack may require that old versions of some code files be present and in predictable locations.
Resources required
The adversary needs to have enough access to the target application to control the identity of a locally included file. The attacker may also need to be able to upload arbitrary code files to the target machine, although any location for these files may be acceptable.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Execute Unauthorized Commands | Integrity | Through local code inclusion, the adversary compromises the integrity of the application. |
| Read Data | Confidentiality | An attacker may leverage local code inclusion in order to print sensitive data to a page, such as hidden configuration files or or password hashes. |
Mitigations
Implementation: Avoid passing user input to filesystem or framework API. If necessary to do so, implement a specific, allowlist approach.
Weaknesses it exploits
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Recent CVEs with these weaknesses
- 4.4CVE-2026-123858
In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects
- 5.5CVE-2026-123854
In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module
- 7.8CVE-2026-123853
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process
- 7.0CVE-2026-123849
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers
- 3.3CVE-2026-123843
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
- 7.8CVE-2026-123838
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
- 3.6CVE-2026-123833
In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects
- 9.6CVE-2026-123832
In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-175 Code Inclusion
MITRE's words, unchanged: CAPEC-251 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.