cve.bz

CAPEC-252

PHP Local File Inclusion

Medium severityDetailed pattern

The attacker loads and executes an arbitrary local PHP file on a target machine. The attacker could use this to try to load old versions of PHP files that have known vulnerabilities, to load PHP files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-252: PHP Local File Inclusion: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/252.html and https://cve.bz/cve/capec/252?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Survey application] Using a browser or an automated tool, an adversary follows all public links on a web site. They record all the links they find. The adversary is looking for URLs that show PHP file inclusion is used, which can look something like "http://vulnerable-website/file.php?file=index.php".

      3 techniques
      • Use a spidering tool to follow and record all links. Make special note of any links that include parameters in the URL.
      • Use a proxy tool to record all links visited during a manual traversal of the web application. Make special note of any links that include parameters in the URL. Manual traversal of this type is frequently necessary to identify forms that are GET method forms rather than POST forms.
      • Use a browser to manually explore the website and analyze how it is constructed. Many browser's plugins are available to facilitate the analysis or automate the URL discovery.

  2. Experiment

    They probe what they found.

    1. [Attempt variations on input parameters] Once the adversary finds a vulnerable URL that takes file input, they attempt a variety of path traversal techniques to attempt to get the application to display the contents of a local file, or execute a different PHP file already stored locally on the server.

      2 techniques
      • Use a list of probe strings to inject in parameters of known URLs. The probe strings are variants of path traversal techniques used to include well known files.
      • Use a proxy tool to record results of manual input of local file inclusion probes in known URLs.

  3. Exploit

    They carry out the attack.

    1. [Include desired local file] Once the adversary has determined which techniques of path traversal successfully work with the vulnerable PHP application, they will target a specific local file to include. These can be files such as "/etc/passwd", "/etc/shadow", or configuration files for the application that might expose sensitive information.

Prerequisites

  • The targeted PHP application must have a bug that allows an attacker to control which code file is loaded at some juncture.

Resources required

  • The attacker needs to have enough access to the target application to control the identity of a locally included PHP file.

Weaknesses it exploits

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Recent CVEs with these weaknesses

  1. 4.4CVE-2026-123858

    In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

  2. 5.5CVE-2026-123854

    In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

  3. 7.8CVE-2026-123853

    In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process

  4. 7.0CVE-2026-123849

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers

  5. 3.3CVE-2026-123843

    In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

  6. 7.8CVE-2026-123838

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

  7. 3.6CVE-2026-123833

    In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects

  8. 9.6CVE-2026-123832

    In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

The newest records naming one of them. Each weakness's page lists them all.

Part of

MITRE's words, unchanged: CAPEC-252 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.