Common Weakness Enumeration

    CWE Definition / CWE-98

    CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

    The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in require, include, or similar functions.

    Published:19 Jul 2006
    Organization:MITRE
    Modified:11 Dec 2025

    Related Weakness

    CWE-706: Use of Incorrectly-Resolved Name or Reference

    CWE-829: Inclusion of Functionality from Untrusted Control Sphere

    CWE-94: Improper Control of Generation of Code ('Code Injection')

    CWE-426: Untrusted Search Path