cve.bz

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program (Remote file include)

Filter

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

What the weakness is: CWE-98 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 1
  • CAPEC-193 PHP Remote File Inclusion Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-98, as MITRE names them. Credits.

Ask an AI about CWE-98

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/98.html and https://cve.bz/cve/cwe/98?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.7CVE-2026-73695EPSS 1.0%

    Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatena…

  2. 6.5CVE-2026-62121EPSS 0.4%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor…

  3. 8.7CVE-2010-20125EPSS 0.6%

    DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers…

  4. 5.9CVE-2026-110185EPSS 0.6%

    The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field ref…

  5. 7.1CVE-2014-125137EPSS 0.7%

    C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversa…

  6. 8.1CVE-2026-112850EPSS 0.3%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4…

  7. 9.8CVE-2026-112832EPSS 0.4%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.

  8. 8.1CVE-2026-112820EPSS 0.4%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/…

  9. 7.7CVE-2017-20289EPSS 0.9%

    Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.…

  10. 9.2CVE-2016-20101EPSS 0.4%

    Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/docum…

  11. 7.1CVE-2026-113402EPSS 0.4%

    ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.

  12. 6.5CVE-2026-111829EPSS 0.3%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1…

  13. 5.3CVE-2026-62858EPSS 0.5%

    YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash trave…

  14. 7.5CVE-2026-110284EPSS 0.7%

    The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. T…

  15. 8.1CVE-2026-104909EPSS 1.0%

    The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to includ…

  16. 8.1CVE-2026-103367EPSS 1.0%

    The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unau…

  17. 8.1CVE-2026-104995EPSS 1.1%

    The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory …

  18. 8.1CVE-2026-66566EPSS 0.3%

    Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

  19. 8.1CVE-2026-62115EPSS 0.3%

    Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

  20. 8.1CVE-2026-62099EPSS 0.3%

    Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

  21. 8.1CVE-2026-62096EPSS 0.3%

    Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

  22. 8.1CVE-2026-62094EPSS 0.3%

    Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

  23. 8.1CVE-2026-62092EPSS 0.3%

    Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

  24. 8.1CVE-2026-62075EPSS 0.3%

    Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

  25. 8.1CVE-2026-62074EPSS 0.3%

    Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

  26. 8.1CVE-2026-62070EPSS 0.3%

    Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

  27. 8.1CVE-2026-62069EPSS 0.3%

    Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

  28. 8.1CVE-2026-62068EPSS 0.3%

    Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

  29. 8.1CVE-2026-62067EPSS 0.3%

    Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

  30. 8.1CVE-2026-62066EPSS 0.3%

    Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

  31. 8.1CVE-2026-62065EPSS 0.3%

    Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

  32. 9.8CVE-2026-62032EPSS 0.3%

    Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

  33. 8.1CVE-2026-62020EPSS 0.3%

    Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

  34. 8.1CVE-2026-48194EPSS 0.3%

    Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

  35. 8.1CVE-2026-48193EPSS 0.3%

    Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

  36. 8.1CVE-2026-42777EPSS 0.3%

    Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

  37. 8.1CVE-2026-42724EPSS 0.3%

    Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

  38. 8.1CVE-2026-42704EPSS 0.3%

    Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

  39. 8.1CVE-2026-104899EPSS 0.6%

    The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This make…

  40. 8.1CVE-2026-94067EPSS 0.3%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.

  41. 8.1CVE-2026-94062EPSS 0.3%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.

  42. 7.5CVE-2026-75028EPSS 0.7%

    The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for…

  43. 7.5CVE-2026-92174EPSS 0.5%

    The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor…

  44. 7.1CVE-2026-71426EPSS 0.3%

    GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's …

  45. 8.8CVE-2026-96837EPSS 0.5%

    Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

  46. 7.5CVE-2026-89294EPSS 1.0%

    The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with …

  47. 7.5CVE-2026-50547EPSS 0.5%

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and inc…

  48. 7.5CVE-2026-49850EPSS 0.3%

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST …

  49. 9.1CVE-2026-39353EPSS 0.4%

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an ad…

  50. 7.5CVE-2026-13456EPSS 0.8%

    The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes …