LFI / path traversal

When it applies

A parameter or path segment controls which file the server reads/includes. Path traversal reads arbitrary files; LFI (include) can execute them → RCE.

Why it works

The app builds a filesystem path from user input without normalizing/constraining it, so ../ sequences escape the intended directory. If the value is included (PHP), included content is executed.