george0papasotiriou/cve-2026-21015-php-filter-chain-arbitrary-file-readPoC exploit for CVE-2026-21015 that abuses PHP filter chains to read arbitrary files through a vulnerable include() call, disclosing source and credentials.
// vulnerable.php - Includes file based on user input via filter
<?php
$file = $_GET['page'];
// Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper
include("php://filter/convert.base64-encode/resource=" . $file);
A PHP application uses php://filter to include files based on user input without proper validation. An attacker can leverage the base64‑encode filter and path traversal to read arbitrary files on the server.
python exploit_php_filter.py
The content of /etc/passwd is returned.