Filesystem security

When to use this skill

Use this skill whenever code touches the filesystem with paths derived from input:

• Building a file path from $_GET / $_POST / $_REQUEST.
• include, require, readfile, file_get_contents, or unlink of a dynamic file.
• Serving downloads, exports, or logs based on a request parameter.
• Deleting files selected by the user.
• Using WP_Filesystem for writes, deletes, or directory creation.

Path traversal and local file inclusion are high-impact WordPress vulnerabilities — ../../wp-config.php or a malicious uploaded .php can expose secrets or achieve RCE.

Related: see the file-upload-security skill for $_FILES handling and the object-injection-deserialization skill for uploaded data formats.

Core principles (and why they matter)