file inclusion
termsecurityweb dev
Stands for: LFI and RFI
Getting an application to read or execute a file the caller chose, by controlling a path it builds from input.
It belongs to the same family as injection: user input reaching an interpreter, in this case the filesystem. Reading is bad enough - configuration files, credentials, keys - and it escalates to execution whenever the application will run what it includes. Filtering the path is the losing strategy for the familiar reason: every encoding, every traversal variant and every layer of normalisation between the check and the open is another chance for the two to disagree, which is why the durable fix is to never build a path from input at all.
Also known as: LFI, path traversal