Path traversal and Local File Inclusion

January 21, 2026 · 1 min read · #web #path-traversal #lfi

If a filename comes from the user and is concatenated to a path, ../ climbs the tree:

GET /download?file=../../../../etc/passwd

From reading to executing

In PHP include($_GET['page'].'.php') is worse: if you control what gets included and can plant PHP code in a readable file (logs, uploads, the php://filter or data:// wrapper), you get execution. This is Local File Inclusion.

?page=php://filter/convert.base64-encode/resource=config

Defence

Do not build paths from input. If unavoidable: basename(), a whitelist of allowed files, canonicalize with realpath() and verify the result stays inside the base directory. Disable dangerous wrappers (allow_url_include=Off).

« back to home