Skip to main content

Local file inclusion


The application allows to read or execute files located on the server through relative paths manipulation in the input fields.


  • Visualize the content of sensitive files stored on the server.
  • Get sensitive data.
  • Read system files.


  • Validate that the parameters received by the application do not contain relative paths.
  • Disable insecure functions that allow reading of arbitrary files on the server.


Unauthorized attacker from local network.

Expected Remediation Time

โŒš 120 minutes.


Default score using CVSS 3.1. It may change depending on the context of the vulnerability.


  • Attack vector: N
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: C
  • Confidentiality: H
  • Integrity: N
  • Availability: N


  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X


  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 8.6
    • Temporal: 8.6
  • Severity:
    • Base: High
    • Temporal: High

Code Examples

Compliant code

All input parameters are validated to ensure they do not contain relative routes

private String getFile(userReq){
try {
//Function to validate that parameter does not contain relative routes
isValidReq = validateReq(userReq)
//Read files from a remote direction not local
if (isValidReq){
File file = new File(classLoader.getResource("secureurl").getFile());
//Code to do something with that file

Non compliant code

The application includes a reference to a local path that could be altered by the user

private String getLocalFile( userReq){
try {
Path = "/localPath/" + userReq
File file = new File(classLoader.getResource(Path).getFile());
//Code to do something with that file