Cybersecurity glossary
What is Remote File Inclusion (RFI)?
Learn what Remote File Inclusion (RFI) is, how applications include attacker-controlled remote files, how RFI leads to remote code execution, and how to prevent it by disabling remote includes.
Definition
Remote File Inclusion (RFI) is a vulnerability in which an application includes or executes a file from a remote URL based on user-controllable input, allowing attackers to supply malicious code hosted on their servers and often achieve remote code execution.
Why RFI matters
Dynamic include features are convenient for templates and plugins. When the include target can be a URL controlled by an attacker, convenience becomes Remote File Inclusion (RFI)—and often instant remote code execution.
Historically associated with PHP allow_url_include, RFI taught a durable lesson: application runtimes should not fetch and execute remote code based on request parameters.
How RFI works
Find a dynamic include parameter
page, template, module, or lang parameters that map to include/require/load calls.
Supply a remote URL
Point the parameter at an attacker-controlled HTTP(S) resource hosting malicious code.
Server fetches the remote file
The runtime retrieves the attacker content because remote includes are enabled.
Content is executed or evaluated
Included code runs with the privileges of the application process.
Attacker gains RCE
Webshells, reverse shells, or in-process implants establish control.
Disable and remediate
Turn off remote includes, fix code paths, and hunt for planted persistence.
RFI vs LFI vs SSRF
| Issue | What happens |
|---|---|
| RFI | Remote file is included/executed by the application runtime |
| LFI | Local filesystem file is included/read via unsafe path input |
| SSRF | Server requests a URL primarily to access data/services, not to include as code |
Prevention checklist
Disable remote includes
Turn off runtime features that allow URL-based include/require behavior.
Allowlist local templates
Map parameter values to fixed local files; never concatenate raw URLs.
Block unexpected schemes
Reject http, https, ftp, and php wrappers in file parameters.
Least privilege
Limit what RCE can do if a loader bug still appears.
- Audit all dynamic include/require/load paths for user influence.
- Ensure production runtimes disable allow_url_include and similar settings.
- Prefer modern templating that cannot fetch remote executable code.
- Monitor outbound fetches from app servers to unusual destinations.
- Treat RFI findings as critical due to likely RCE impact.
- Review plugin systems that load code by name or URL.
- Add tests that attempt remote URL inclusion and expect rejection.
- After incidents, rotate secrets and hunt for webshells aggressively.
The practical takeaway
Remote File Inclusion (RFI) lets attackers make an application include and often execute code from a remote URL. It is a direct path to RCE when remote includes are possible.
Disable remote include features, allowlist local resources only, and never trust request parameters as executable file locations.
Related security terms
Local File Inclusion (LFI)
Includes local files instead of remote URLs; often related in vulnerable include features.
Remote Code Execution (RCE)
The common impact when remote included content is executed.
Directory Traversal
Path manipulation sometimes used alongside inclusion flaws.
Server-Side Request Forgery (SSRF)
A related server-side fetch abuse with different primary goals.
Frequently asked questions
What is RFI in simple terms?
RFI happens when a website loads a file from an address you control—like a URL—and runs or includes it. Attackers host malicious code and trick the site into including that URL.
How is RFI different from LFI?
LFI includes files already on the server. RFI includes files from remote locations over the network. Both abuse unsafe include/load features.
Why was RFI common in PHP?
Older PHP configurations allowed URL includes via settings like allow_url_include, so parameters passed to include/require could load remote scripts.
Does RFI always mean RCE?
Often yes when the included remote content is executed as code. Even without execution, remote includes can pull attacker-controlled data into sensitive contexts.
How do you prevent RFI?
Never pass user input to include functions, disable remote URL includes in the runtime, and allowlist local templates only.
Is SSRF the same as RFI?
No. SSRF makes the server request URLs for data access. RFI specifically includes/executes remote files in the application runtime. They can overlap when URL fetches feed includes.
Do modern frameworks still have RFI?
Less often in default configs, but custom dynamic loaders, plugin systems, and misconfigured runtimes can still introduce RFI-like behavior.
References
Explore authoritative guidance and frameworks related to remote file inclusion (rfi).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.