What is Improper Control of Filename (CWE-98)?

TL;DR: Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) (CWE-98) is a critical vulnerability that occurs when the PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. To fix this vulnerability, you should implement input validation mechanisms.

At-a-Glance

What is Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)?

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) (CWE-98) is a type of vulnerability that occurs when the PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in “require,” “include,” or similar functions. This vulnerability can lead to arbitrary code execution and data breaches.

As defined by the MITRE Corporation under CWE-98, and classified by the OWASP Foundation under A05:2025 - Injection, this vulnerability is a critical issue that requires immediate attention.

Quick Summary

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) (CWE-98) is a critical vulnerability that can lead to arbitrary code execution and data breaches. This vulnerability occurs when the PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in “require,” “include,” or similar functions.

Jump to: Quick Summary · Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) Overview · Business Impact of Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) · Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) Attack Scenario · How to Detect Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) · How to Fix Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) · Framework-Specific Fixes for Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) · How to Ask AI to Check Your Code for Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) · Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) Best Practices Checklist · Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) FAQ · Vulnerabilities Related to Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) · References · Scan Your Own Site

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) Overview

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) (CWE-98) is a critical vulnerability that can lead to arbitrary code execution and data breaches. This vulnerability occurs when the PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in “require,” “include,” or similar functions.

How Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) Works

Root Cause

The root cause of this vulnerability is the lack of proper input validation mechanisms in place. The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in “require,” “include,” or similar functions.

Attack Flow

1. The attacker sends a specially crafted input to the PHP application.
2. The PHP application uses the input without proper validation, leading to arbitrary code execution and data breaches.

Prerequisites to Exploit

• The PHP application receives input from an upstream component.
• The input is not properly validated before its usage in “require,” “include,” or similar functions.

Vulnerable Code

<?php
    $input = $_GET['file'];
    include($input);
?>

This code demonstrates a vulnerable scenario where the PHP application includes a file based on user input without proper validation. This can lead to arbitrary code execution and data breaches.

Secure Code

<?php
    $allowed_files = array('index.php', 'style.css');
    $input = $_GET['file'];
    if (in_array($input, $allowed_files)) {
        include($input);
    } else {
        echo "Error: File not found.";
    }
?>

This code demonstrates a secure scenario where the PHP application includes a file based on user input only after proper validation. This prevents arbitrary code execution and data breaches.

Business Impact of Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)

The business impact of Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) (CWE-98) includes potential data breaches, financial losses, and reputational damage. Confidentiality may be compromised as sensitive data may be exposed. Integrity may also be affected as unauthorized code can be executed.

Confidentiality

• Sensitive data may be exposed due to arbitrary code execution.
• Data breaches may occur, leading to loss of confidential information.

Integrity

• Unauthorized code can be executed, leading to modification of sensitive data.
• Data integrity may be compromised, leading to financial losses and reputational damage.

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) Attack Scenario

1. The attacker sends a specially crafted input to the PHP application.
2. The PHP application uses the input without proper validation, leading to arbitrary code execution and data breaches.

How to Detect Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)

You can use manual testing by checking the input validation mechanisms in place. Automated scanners (SAST/DAST) can also be used to identify potential vulnerabilities. PenScan’s detection capabilities include identifying potential weaknesses and providing recommendations for remediation.

Manual Testing

• Search the codebase for include/require/include_once/require_once calls where the argument is built from $_GET, $_POST, or another request-derived variable.
• Test each one by supplying a path to a local file outside the intended directory, and separately a URL (if allow_url_include might be on) to confirm whether remote file inclusion is actually reachable.
• Confirm the include path is restricted to an allowlist of known filenames rather than just checked for a substring like http://.

Automated Scanners (SAST/DAST)

Static analysis can flag an include/require call whose argument traces back to a request parameter with no allowlist check in between; dynamic testing is needed to confirm whether the running PHP configuration (allow_url_include, allow_url_fopen) actually permits remote inclusion, since the same code is exploitable or not depending on php.ini.

PenScan Detection

PenScan’s Nuclei and ZAP engines actively test include/require-style parameters with local- and remote-path payloads to confirm file inclusion is reachable.

False Positive Guidance

A finding on an include/require call whose argument is drawn from a fixed, developer-controlled allowlist (never directly from request data) is a false positive — the weakness requires the filename itself to be attacker-influenced.

How to Fix Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)

To fix this vulnerability, you should implement input validation mechanisms that restrict the input before its usage in “require,” “include,” or similar functions. This can be achieved by using libraries or frameworks that provide constructs to make this weakness easier to avoid.

Potential Mitigations

• Use a vetted library or framework that does not allow this weakness to occur.
• Implement input validation mechanisms that restrict the input before its usage in “require,” “include,” or similar functions.

Framework-Specific Fixes for Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)

PHP

<?php
    $allowed_files = array('index.php', 'style.css');
    $input = $_GET['file'];
    if (in_array($input, $allowed_files)) {
        include($input);
    } else {
        echo "Error: File not found.";
    }
?>

This code demonstrates a secure scenario where the PHP application includes a file based on user input only after proper validation.

How to Ask AI to Check Your Code for Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)

You can use a copy-paste prompt with an AI coding assistant, such as “Review the following [language] code block for potential CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) vulnerabilities and rewrite it using [primary fix technique]: [paste code here].”

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) Best Practices Checklist

✅ Implement input validation mechanisms that restrict the input before its usage in “require,” “include,” or similar functions. ✅ Use libraries or frameworks that provide constructs to make this weakness easier to avoid. ✅ Store library, include, and utility files outside of the web document root.

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) FAQ

How does Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) occur?

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) occurs when the PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

What is the impact of Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)?

The attacker may be able to specify arbitrary code to be executed from a remote location. Alternatively, it may be possible to use normal program behavior to insert php code into files on the local machine which can then be included and force the code to execute since php ignores everything in the file except for the content between php specifiers.

How do I detect Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)?

You can use manual testing by checking the input validation mechanisms in place. Automated scanners (SAST/DAST) can also be used to identify potential vulnerabilities. PenScan’s detection capabilities include identifying potential weaknesses and providing recommendations for remediation.

How do I fix Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)?

To fix this vulnerability, you should implement input validation mechanisms that restrict the input before its usage in "require," "include," or similar functions. This can be achieved by using libraries or frameworks that provide constructs to make this weakness easier to avoid.

What are some best practices for preventing Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)?

Some best practices include implementing input validation mechanisms, using libraries or frameworks that provide constructs to make this weakness easier to avoid, and storing library, include, and utility files outside of the web document root.

Can you explain the business impact of Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)?

The business impact includes potential data breaches, financial losses, and reputational damage. Confidentiality may be compromised as sensitive data may be exposed. Integrity may also be affected as unauthorized code can be executed.

What is the attack scenario for Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)?

The attacker sends a specially crafted input to the PHP application, which is then used to include an arbitrary file. This allows the attacker to execute arbitrary code.

How can I ask AI to check my code for Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)?

You can use a copy-paste prompt with an AI coding assistant, such as “Review the following [language] code block for potential CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) vulnerabilities and rewrite it using [primary fix technique]: [paste code here].”

What are some common related vulnerabilities to Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)?

Some common related vulnerabilities include CWE-706 (Use of Incorrectly-Resolved Name or Reference) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).

Vulnerabilities Related to Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)

References

• https://cwe.mitre.org/data/definitions/98.html (MITRE)
• https://owasp.org/www-content/library/html/A05_2025-Injection.html (OWASP)
• https://capec.mitre.org/data/definitions/193.html (CAPEC)
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) and other risks before an attacker does.