AIKIDO-2026-975500

TL;DR

When Server-Side Includes are enabled, the include directive handler concatenates the directive path into a filesystem path without sanitizing ../ sequences. Content that reaches an .shtml file can therefore read arbitrary files readable by the process, such as system password files, configuration, or private keys. Exploitation requires control over included content but no elevated privileges. The fix validates include paths before opening them.