Avoid include/require with user-controlled paths
Include and require statements must not load files from request-derived or tainted path values.
#Metadata
#Why it matters
User-controlled includes can load attacker-chosen PHP and lead to remote code execution.
#Remediation
Map user input to an allowlisted template name and include only fixed, reviewed file paths.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/php/php.security.unsafe-include-with-user-input.rule.yaml.