Local File Inclusion

Local File Inclusion (LFI) is a web application vulnerability that lets an attacker cause the inclusion and reading of arbitrary files residing on the server. The flaw arises when an application builds the path to an included file from user-supplied input without proper validation.

How an LFI attack works

The vulnerability typically affects scripts that load files based on a URL parameter, for example ?page=contact. If the application inserts the parameter value straight into a file-inclusion function (such as include in PHP), an attacker can swap it for a path to another file. The classic technique is path traversal — using ../ sequences to climb out of the intended directory and reach system files, configuration files or credentials. In severe cases, combined with other weaknesses (such as the ability to write to logs), LFI leads to remote code execution. This is a different vector from SQL injection or XSS, though all stem from the same sin: trusting user input.

Practical application

Defending against LFI rests on a few principles. The foundation is strict validation and sanitization of input — ideally an allowlist of permitted values, rather than attempting to filter out dangerous characters. Raw user parameters should never be passed directly into functions that operate on files. Proper server and permission configuration also helps, along with running the application with least privilege and an application firewall (WAF) that catches common path-traversal patterns.

The LFI vulnerability appears in OWASP classifications under broken access control and injection flaws. Regular penetration testing and code review are the most effective way to find such gaps before an attacker does.