Invicti identified a Code Evaluation via Local File Inclusion (PHP).

An attacker can execute arbitrary PHP code by abusing the Local File Inclusion vulnerability on the server.

• If possible, do not permit file paths to be appended directly. Make them hard-coded or selectable from a limited hard-coded path list via an index variable.
• If you definitely need dynamic path concatenation, ensure you only accept required characters such as "a-Z0-9" and do not allow ".." or "/" or "%00" (null byte) or any other similar unexpected characters.
• It is important to limit the API to allow inclusion only from a directory and directories below it. This ensures that any potential attack cannot perform a directory traversal attack.