Home / Knowledge hub / Local file inclusion
Knowledge hub
Local file inclusion
Making an app read and show a file from its own server that it should not.
What it means
Local file inclusion, or LFI, is when an application builds a file path from user input and then reads, or includes, that file. A page address such as ?page=about is a typical sign, where the value picks a file on the server.
If the application does not control the value, a visitor can point it at other files on the same machine, such as configuration, source code or system files, and the application hands over the contents. The server is not hacked in any special way; it is simply asked, and it answers with a file it should have kept to itself.
Why it matters
Files on a server often hold database passwords, API keys and private source code. Reading one can lead directly to further access. In some languages, including PHP, an included file is also executed, so a file the attacker can influence, like a log or an upload, can turn the weakness into remote code execution.
LFI is closely related to path traversal. The difference is the effect: traversal reads a file, inclusion may also run it. MITRE covers the include case in CWE-98 and the path case in CWE-22. Reading a single configuration file can hand an attacker the keys to your database and your cloud account, so the effect goes far beyond the page where it started.
How it shows up
You meet it in templates chosen by a parameter, language or theme switches, download endpoints, report viewers and legacy PHP pages. The usual mistakes are trusting the parameter, filtering only the literal sequence ../ while encoded versions pass, and appending an extension that can be cut off by tricks in older runtimes.
Do not pass paths from users. Map a short list of names to files on the server, so an unknown value is refused. If you must accept a path, resolve it to its canonical form and confirm it is inside the allowed folder. Run the application with minimal file permissions. Test with traversal sequences.
Questions people ask
Local file inclusion, answered
What is the difference between LFI and path traversal?
Path traversal is escaping the intended folder to read files. Local file inclusion is a file being loaded by the application, often as code.
They share a cause: user-controlled paths. Inclusion can be worse because it may execute what it loads.
Can LFI lead to code execution?
Yes, in environments that run included files. If the attacker can get their own content into any file the server will include, such as a log, the include executes it.
This is why LFI is often rated critical.
Does adding a fixed extension prevent LFI?
Not reliably. It limits which files are readable, but encoded tricks and older runtime behaviour have bypassed it in the past.
A fixed list of allowed names is a much safer approach.
Which files do attackers go after first?
Configuration files with secrets, environment files, application source and operating system files that confirm the weakness.
Remove secrets from the server's disk where you can and use a secrets manager.
How do we test for LFI?
Change any parameter that looks like a file or page name to a traversal sequence and a known harmless file, and see if its contents appear.
Test with encoded variants, as plain sequences are often filtered.
Related
Terms that sit next to this one
Path traversal
Using a crafted file name to reach files outside the intended folder.
Remote file inclusion
Making an app load and run code from an address the attacker controls.
Remote code execution
Getting a server to run commands of an attacker's choosing.
File upload vulnerability
An upload feature that accepts files it should refuse, such as scripts.
Hardcoded secret
A password, API key or token written straight into source code.
Which file would your app hand over?
Page and download parameters often pick files on the server. We test them and report the file that came back, with the request and response, and, in white-box mode, the line of code. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.