thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Remote File Inclusion (RFI)

A vulnerability where an application includes and executes a file from a remote URL supplied by the user.

Definition

RFI typically leads directly to remote code execution. In PHP it requires allow_url_include, which is disabled by default in modern versions. Mitigations: disable remote includes, allowlist files and validate input.

Example

A template parameter accepting a URL causes the server to fetch and execute remote code.

Exam tip

RFI is generally more severe than LFI because it executes attacker-hosted code.

Related terms