Local File Inclusion (LFI) vulnerabilities allow attackers to manipulate HTTP parameters to read or execute arbitrary files on a server, potentially exposing source code, credentials, and enabling remote code execution.
LFI occurs when web applications use unsanitized user input in file-loading functions like PHP's include(), NodeJS's fs.readFile(), Java's include, or .NET's Response.WriteFile().
Some functions only read file content (safe for execution) while others execute files as code; PHP include() and .NET include execute, while file_get_contents() and fs.readFile() only read.
File inclusion vulnerabilities span multiple frameworks and languages (PHP, NodeJS, Java, .NET) and are typically exploited through parameters like ?language= or URL path segments.
Even read-only LFI is critical because leaked source code may reveal database credentials, admin keys, or additional vulnerabilities for further exploitation.