What is Local File Inclusion?

Local file inclusion (LFI) occurs when an application includes a user-influenced local file as code, a template or page component. A parameter is often intended to select only a language or view but is passed directly to an include or template function. An attacker can then select other files on the server.

How does LFI arise?

An application may conceptually load include("pages/" + page + ".php"). Without a fixed mapping, manipulated input can leave the intended directory or point to another local resource. Automatically appended extensions, decoding, legacy null-byte behavior and platform paths affect which files are reachable. Modern frameworks reduce classic patterns, but custom loaders, legacy applications and dynamic template selection remain relevant.

What impact does LFI have?

Operating-system permissions, container or chroot boundaries, and the application process determine which files are readable. Low privileges contain impact but do not fix the inclusion flaw.

When does it become code execution?

LFI does not automatically result in remote code execution. An attacker usually needs to place controlled content in a file that is later interpreted as executable code. Historical chains used manipulated log entries, session files, temporary uploads or other writable resources. Success depends on the interpreter, file format, known path, write capability and configuration. File disclosure can be critical even without execution.

LFI, path traversal or RFI?

How is LFI prevented?

1. Map external values such as en or invoice to known templates in a fixed server-side map.
2. Never pass full paths, wrappers or URLs from request data to include functions.
3. Separate application code, uploads, logs, sessions and temporary files with appropriate permissions.
4. Disable unnecessary interpreter wrappers and remote includes; hide internal paths in production errors.
5. If file selection is unavoidable, validate the canonical path and allowlist immediately before access.

Code example: select templates through fixed identifiers

Vulnerable:

include __DIR__ . '/pages/' . $_GET['page'] . '.php';

Safer:

$pages = [
    'help' => __DIR__ . '/pages/help.php',
    'contact' => __DIR__ . '/pages/contact.php',
];

$page = $_GET['page'] ?? 'help';
if (!array_key_exists($page, $pages)) {
    http_response_code(404);
    exit;
}

include $pages[$page];

Sanitising a filename is weaker than this mapping because it can still expose unexpected files within a directory. If the application only needs to return text, it must not interpret that content through PHP include.

How is LFI tested?

Testers inventory language, template, download, theme and preview parameters and determine whether unexpected local files can be loaded. A minimal proof uses a harmless known file and avoids retrieving production secrets. Potential write sources and interpretation are then assessed without executing code unless explicitly approved. Different errors, response content and server logs help confirm the issue.