thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Local File Inclusion (LFI)

A vulnerability where an application includes or reads a local file whose path is controlled by user input.

Definition

Common in PHP include() or template loaders, LFI can disclose sensitive files and sometimes lead to code execution. Mitigations include allowlisting includable files, avoiding dynamic includes and path traversal defenses.

Example

A page parameter is passed to include() and can read configuration files.

Exam tip

LFI reads local files; RFI loads remote code. Both are fixed by allowlisting includes.

Related terms