PHP allow_url_include Is Enabled

Severity: Low

Invicti detected that the allow_url_include directive is enabled.


When allow_url_include is enabled, PHP can include scripts from remote locations, such as HTTP or FTP servers. In practice, this feature is hardly used by any application. However, this feature can lead to serious security vulnerabilities. Namely, an attacker can use it to turn a local file inclusion vulnerability into a remote file inclusion vulnerability, either enabling or simplifying the achievement of remote code execution.

Actions To Take#

In order to disable allow_url_include, please add or modify the respective php.ini configuration option as seen below. This configuration option is available since PHP 5.2.0 and was marked as deprecated as of PHP 7.4.0.

allow_url_include = Off

Build your resistance to threats. And save hundreds of hours each month.

Get a demo See how it works