Cybersecurity glossary
What is Local File Inclusion (LFI)?
Learn what Local File Inclusion (LFI) is, how attackers include sensitive local files through unsafe path parameters, how LFI can lead to RCE, and how to prevent it with safe file handling.
Definition
Local File Inclusion (LFI) is a vulnerability in which an application includes or reads files from the local filesystem based on user-controllable input without sufficient validation, allowing attackers to access sensitive files or, in some cases, escalate to remote code execution.
Why LFI matters
Dynamic applications often load templates, language packs, or plugins by name. When that name comes from a request parameter and flows into include, require, file_get_contents, or similar APIs without an allowlist, attackers can point the application at /etc/passwd, application configs, or other local files.
Local File Inclusion (LFI) is therefore both an information disclosure bug and, under the right conditions, a stepping stone to remote code execution. It remains common in older PHP apps and in any framework that builds filesystem paths from request data.
How LFI works
Find an inclusion parameter
Look for page, template, lang, file, or module parameters that change server-side includes.
Supply a local path
Attempt absolute paths or traversal sequences to reach sensitive files.
Confirm file disclosure
Responses reveal file contents or errors that prove the file was touched.
Hunt for secrets
Read configs, keys, source, and environment material accessible to the app user.
Attempt execution paths
If possible, include writable locations (uploads, logs) containing injected code.
Escalate impact
Move from read to RCE, persistence, or lateral movement depending on privileges.
LFI vs related file bugs
| Issue | Core idea |
|---|---|
| LFI | Include/read a local file chosen via user input |
| RFI | Include a remote file/URL chosen via user input |
| Directory traversal | Escape a base directory to access unexpected paths |
| Unsafe file download | Read files for download without executing them as code |
Impact scenarios
Credential and config theft
Database passwords and API keys in config files become readable.
Source code exposure
Application logic and additional vulnerabilities are revealed.
Log poisoning to RCE
Attackers inject PHP into logs, then include the log file.
Upload + include
A seemingly harmless upload becomes executable when included.
Prevention checklist
- Map template names to server-side allowlists; never concatenate raw paths from users.
- Disable dangerous remote include features in runtimes that still offer them.
- Canonicalize paths and enforce a root directory if dynamic files are unavoidable.
- Store uploads outside the web root and never include them as code.
- Run the application with least filesystem privilege.
- Log and alert on repeated traversal and sensitive path probes.
- Prefer safe templating engines that do not execute arbitrary filesystem paths.
- Include LFI cases in code review and DAST for any file/template parameters.
The practical takeaway
Local File Inclusion (LFI) lets attackers coerce an application into loading local files through unsafe parameters. Disclosure is the baseline impact; code execution is the upgrade path when includes interpret attacker-controlled content.
Stop building include paths from user input. Allowlist, map IDs to files, and treat every dynamic include as a critical security boundary.
Related security terms
Directory Traversal
Path escaping often used to reach files during LFI exploitation.
Remote File Inclusion (RFI)
A related inclusion flaw that loads remote resources instead of local files.
Remote Code Execution (RCE)
A possible outcome when included files are executed as code.
Server-Side Template Injection (SSTI)
Another server-side interpretation flaw with code-execution potential.
Frequently asked questions
What is LFI in simple terms?
LFI happens when a website lets you choose a file to load—like a page template—and does not stop you from choosing sensitive system files instead of safe templates.
How is LFI different from directory traversal?
Traversal is about escaping a directory boundary to read or write files. LFI specifically includes/loads a local file into the application’s processing or rendering pipeline. Many LFI exploits use traversal sequences.
Can LFI lead to remote code execution?
Yes, in some stacks—especially when attackers can include uploaded files, log files containing injected code, or other executable content the runtime will interpret.
Which languages historically see LFI?
PHP applications with dynamic include/require patterns are classic cases, but similar bugs appear wherever user input selects server-side templates or files to execute/render.
What files do attackers read first?
Configuration files, credential stores, `/etc/passwd` on Linux, application source, and environment files that reveal secrets.
How do you prevent LFI?
Never pass user input directly to include/read APIs. Use allowlists of permitted templates, map IDs to server-side paths, and run with least filesystem privilege.
Does a WAF stop LFI?
A WAF may block obvious `../` payloads, but encoding tricks and app-specific parameters bypass filters. Secure coding is required.
References
Explore authoritative guidance and frameworks related to local file inclusion (lfi).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.