PHP : Unsafe file inclusion

Data from an untrusted source is used to dynamically include files into PHP. This may lead to malicious code execution.

Modern scripting languages allow to dynamically include code from third-party files, which promotes code reuse. This mechanism is often used to maintain the uniform appearance of pages, for code division into smaller units, and similar tasks. File inclusion vulnerabilities occur when the path to the included file is defined based on data from an untrusted source, e.g., user input.