Local File Inclusion (LFI) is a web application vulnerability where attackers manipulate inputs, typically Uniform Resource Locator (URL) parameters, to include unintended files from the server.

Simply put, LFI occurs when a web application dynamically loads files based on user inputs without proper validation. This allows attackers to access local files on the server.

Table of Contents

Read More about LFI

LFI can be likened to the following real-world scenario.

Think of a website like a hotel concierge. When you ask the concierge for your room details, he fetches a file from a directory. Normally, you should only get approved files or those that belong to you (e.g., room101.txt). But if the concierge blindly trusts your request, you could ask for the employee passwords file instead and get the information.

That is essentially what LFI does. It tricks a system into opening files it should never expose.

How LFI Works

You should know that LFI vulnerabilities typically arise from code that dynamically includes files. Take a closer look at the following example.

If your web application has this sample PHP code:

<?php
$page = $_GET[‘page’];
include($page);?>

A normal request would look like this:

https://example.com/index.php?page=home.php

But, attackers can modify it to:

https://example.com/index.php?page=../../../../etc/passwd

If that happens, the application takes the user input (page parameter) and passes it directly to a file inclusion function.

The attackers can then inject a path traversal payload. How? They typically use sequences like:

../

This allows them to move up directories and access restricted files.

If that is the case, the server will include a sensitive file (e.g., /etc/passwd on a Linux system).

Here is a simple diagram showing a sample LFI attack flow.

LFI Attack Flow

Programming Languages Affected by LFI

While LFI is most commonly associated with PHP, it can affect multiple technologies. Take a look at the list below.

LANGUAGE OR PLATFORMWHY IT IS VULNERABLE
PHPBuilt-in functions like include() and require()
ASP/ASP.NETDynamic file rendering via parameters
Java (JSP/Servlets)File-based templates and includes
Python (Flask and Django)Misconfigured template rendering
Node.jsImproper file handling with user input

Here are more detailed explanations:

  • PHP: LFI happens when an application uses PHP file inclusion functions like include(), require(), include_once(), or require_once() with user-controllable input without validation.
  • ASP/ASP.NET: Attackers may attempt to access sensitive files using techniques like Windows file system traversal, web configuration disclosure, or accessing system logs.
  • Java (JSP/Servlets): LFI occurs when applications improperly handle user input to include or serve files, allowing attackers to read sensitive files or escalate to remote code execution (RCE).
  • Python (Flask and Django): LFI happens when unsanitized user input dictates file paths, allowing attackers to read server files via directory traversal.
  • Node.js: LFI occurs when user-controlled input like file paths in fs.readFile() or require() is not properly sanitized, allowing attackers to read or execute arbitrary files on the server using directory traversal.

If you are wondering why PHP is most associated with LFI, that is because PHP historically allowed flexible file inclusion, which, when misused, makes LFI easier to exploit.

How to Test for LFI

Testing for LFI involves identifying inputs that control file paths. You can follow the most common steps indicated below.

  1. Identify parameters: Look for inputs like ?page=, ?file=, or ?include=.
  2. Inject test payloads: Try using ../../../../etc/passwd on Linux or its Windows equivalent ..\..\..\..\windows\win.ini.
  3. Check response: If system file contents appear then you have confirmed the presence of the vulnerability.
  1. Test encoding bypasses: Use the URL encoding %2e%2e%2f.
  1. Test null byte injection on legacy systems: You can, for instance, use file.php%00.

The OWASP testing guide emphasizes identifying unsanitized input used in file operations and systematically testing traversal payloads.

LFI Testing Tools

The LFI testing tools can be broadly categorized into two types—automated and manual.

Automated Tools

  • Burp Suite: Intercepts requests and allows payload injection.
  • OWASP ZAP: Open-source scanner for detecting LFI and other vulnerabilities.
  • Nessus: Identifies LFI issues during automated scans.
  • Acunetix: Enables specialized detection of file inclusion flaws.

Manual Tools

  • Browser + proxy: Using a browser and a proxy (like Burp Suite) allows you to capture and modify application requests, enabling you to manipulate input parameters that the server uses to include files.
  • Curl/Postman: Involves manipulating URL parameters, body data, or headers to include files from the server’s local filesystem.
  • Custom scripts: Involves identifying parameters that include files like ?page=, ?file=, or ?lang= and manipulating them to access unauthorized local files like /etc/passwd or log files.

Notable LFI Vulnerabilities: CVE Examples

Network and IT administrators typically know vulnerabilities by their Common Vulnerabilities and Exposures (CVE) IDs. We listed the CVE IDs of some popularly exploited LFI vulnerabilities below.

CVE-2026-6227

The BackWPup plugin for WordPress is vulnerable to LFI via the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint in all versions up to, and including, 5.6.6 due to a nonrecursive str_replace() sanitization of path traversal sequences.

This makes it possible for authenticated attackers, with administrator-level access and above, to include arbitrary PHP files on the server via crafted traversal sequences, which can be leveraged to read sensitive files like wp-config.php or achieve RCE in certain configurations. Administrators have the ability to grant individual users permission to handle backups, which may then allow lower-level users to exploit this vulnerability.

CVE-2026-5210

This vulnerability was detected in SourceCodester Leave Application System 1.0. It affects an unknown part. Performing a manipulation of the argument page results in file inclusion. Remote exploitation of the attack is possible. The exploit is now public and may be used.

CVE-2026-39684

The Improper Control of Filename for Include/Require Statement in PHP Program or PHP Remote File Inclusion vulnerability in UnTheme OrganicFood organicfood allows PHP LFI. This issue affects OrganicFood: from n/a through <= 3.6.4.

Note that it is important to take note of CVEs because they provide real-world validation of LFI risks, help security teams prioritize patching, and show how common and recurring an issue is.

Real-World LFI Attack Examples

While knowing the CVE IDs of LFI vulnerabilities is important, perhaps real-world examples can provide much more context. Take a look at some below.

Hackers Exploit LFI Flaw in File-Sharing Platforms

Hackers exploited a flaw tracked as CVE-2025-11371 in October 2025, allowing them to access without authentication document root folder files in file-sharing and remote-access software. As a result, they were able to obtain access tokens and passwords to unlock remote access to corporate file systems.

90,000 WordPress Sites Vulnerable to LFI Attacks

A severe security flaw tracked as CVE-2025-0366 in the Jupiter X Core plug-in for WordPress exposed more than 90,000 websites to LFI and RCE attacks. The vulnerability enables authenticated attackers with contributor-level access to upload malicious SVG files and execute arbitrary code on vulnerable servers.

Markdown Menace: Discovering an LFI Vulnerability on a Blogging Platform

In February 2022, an Akamai researcher in conjunction with a CredShields researcher were able to find an LFI vulnerability in Hashnode, a blogging tool known among the developer community. The LFI originated from a Bulk Markdown Import feature that can be manipulated to provide attackers the unimpeded ability to download local files from Hashnode’s server.

Risks and Impact of LFI Attacks

LFI is often underestimated, but it can lead to severe consequences. We categorized these risks into direct and indirect ones below.

Direct Risks

Exposure of sensitive files like:

Indirect Risks

  1. RCE via:
    • Log poisoning
    • File upload + inclusion
  1. Privilege escalation
  2. Full system compromise

Both the direct and indirect risks can pose the following business impacts:

  • Data breaches
  • Service disruption
  • Regulatory penalties
  • Reputational damage

Take a look at a diagram of how an LFI attack can lead to dire consequences.

LFI Vulnerability Exploitation Chain

LFI versus Remote File Inclusion

LFI is just one of the kinds of file inclusion attacks. The other is remote file inclusion (RFI). We summed up their differences below.

FEATURELFIRFI
File sourceLocal serverExternal server
Internet required?NoYes
Risk levelHighVery high
Common inPHP appsMisconfigured PHP settings

Their key difference lies in the type of file loaded. While LFI loads local files, RFI loads remote malicious files.

LFI versus Directory Traversal

While these two are closely related, they are not identical. Take a look at how one compares to the other below.

FEATURELFIDIRECTORY TRAVERSAL
GoalInclude file in application executionAccess files
ExecutionYes in some casesNo
Exampleinclude(file)Direct file read

Simply put, directory traversal lets attackers read files while LFI includes files into application logic.

Common Misconceptions about LFI and Their Practical Implications

Misconceptions

LFI only leaks files.

This statement is not true. In fact, LFI can lead to code execution and even full system takeover.

Modern frameworks are safe from LFI.

While modern frameworks do reduce risks, misconfigurations in them can still create vulnerabilities.

Real-World Implication

Even a simple LFI attack can become critical if combined with file upload features, logging systems, and weak permissions.

LFI Prevention and Mitigation

The following best practices can prevent and mitigate LFI.

  1. Input validation: Never trust user input. And instead of using blocklists, utilize allowlists.
  1. Avoid dynamic file inclusion: Instead of using:

    </> PHP
    include($_GET[‘page’]);

    Use this:

    </> PHP
    $allowed = [‘home’, ‘about’];
    if (in_array($_GET[‘page’], $allowed)) {
        include($_GET[‘page’] . ‘.php’);
    }
  1. Use absolute paths: Avoid using relative paths because they can be manipulated.
  1. Disable dangerous PHP settings: Do not include the following in your code:
  • allow_url_include = Off
  • allow_url_fopen = Off
  1. Apply the least privilege principle: This means restricting file system access and limiting web server permissions.
  1. Use web application firewalls (WAFs): These detect and block LFI payloads.
  1. Perform regular security testing: Use a mix of automated scans and manual testing.

Frequently Asked Questions

What is LFI in simple terms?

LFI is a vulnerability where attackers trick a website into loading files from the server that should not be accessible.

Is LFI still relevant today?

Yes. It remains common in legacy systems and those with poorly validated input handling.

Can LFI lead to RCE?

Yes, especially when combined with log poisoning and file uploads.

How do I detect LFI?

You can detect LFI by testing parameters for file inclusion and using tools like Burp Suite or OWASP ZAP.

What is the difference between LFI and RFI?

LFI uses local files while RFI pulls files from external sources.

Conclusion

LFI remains a deceptively simple vulnerability with far-reaching consequences. What often begins as improper input handling can escalate into sensitive data exposure or even full system compromise when combined with other weaknesses.

Understanding how LFI works helps developers and security teams recognize risks early. Preventing LFI is not about complex tooling alone but about consistent secure coding practices, strict input validation, and minimizing unnecessary file access. By treating user input with caution and regularly testing applications, organizations can significantly reduce their exposure to this persistent and widely exploited vulnerability.

Key Takeaways

  • LFI is a high-impact vulnerability rooted in poor input handling.
  • It often starts as a simple file exposure issue but can escalate into full system compromise.
  • PHP applications are particularly prone, but the issue spans multiple technologies.
  • Effective prevention relies on strict input validation, secure coding practices, and regular testing.
  • Understanding LFI helps teams build safer applications and detect attacks early.

Sources

  • https://www.acunetix.com/blog/articles/local-file-inclusion-lfi/
  • https://nvd.nist.gov/vuln/detail/CVE-2026-6227
  • https://en.wikipedia.org/wiki/File_inclusion_vulnerability
  • https://www.tenable.com/cve/CVE-2026-6227
  • https://medium.com/@carylrobert16/local-file-inclusion-lfi-a-dangerous-yet-overlooked-web-attack-805f9e114db8