# Wrapper scheme file read

User-controlled path or URL reaching file functions that accept php, file, or data wrappers

_Area: Web injection and code execution. Seen in 2 disclosed reports; one confirmed bounty: $8,000; latest 2025-02-12. Updated 2026-10-24._

## How it works
Code assumes a value is a plain filesystem path or a trusted object, but the value is attacker-controlled and reaches a file-reading function (include, file_get_contents, an image loader). PHP stream wrappers (file://, php://filter, data://) and autoload triggers turn that assumption into arbitrary local file read, remote include, or code execution. The broken assumption: "this string is a path we control" or "this parameter is an object."

## Where it shows up
- Factory/loader methods that accept "string" and fetch it (e.g. image `make()`, `file_get_contents`) [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-leaking-file-contents-with-a-blind-file-oracle-in-flarum.md)
- Uploaded file objects whose `__toString()` reaches such a method [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-leaking-file-contents-with-a-blind-file-oracle-in-flarum.md)
- `property_exists()`/`class_exists()`/`method_exists()` called on user-controlled strings — autoload sinks [E1](https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md)
- API methods that type-check an object param but accept a string [E1](https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md)
- Path traversal in URL normalization reaching file endpoints without auth [E3](https://bugbountylibrary.com/r/h1%3A696276.md)[E4](https://bugbountylibrary.com/r/h1%3A694865.md)
- Cleartext secrets in files readable via traversal [E3](https://bugbountylibrary.com/r/h1%3A696276.md)

## How to review
Trace every user-controlled string to file functions and check the invariant: the value must be a validated, canonicalized path with no scheme prefix, or a real object of the expected type. Reject strings containing `://`, `php://`, `file://`, `data://`, or `..` segments. For autoload sinks, confirm the argument is a known class name, not raw input. For traversal, confirm path normalization happens before routing and auth checks.

## Variants seen
- Type confusion feeding `property_exists()` into autoload include, giving RFI/LFI to RCE [E1](https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md)
- Upload stream reaching image loader, enabling `file://` reads and `php://filter` blind file oracle [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-leaking-file-contents-with-a-blind-file-oracle-in-flarum.md)
- Pre-auth path traversal file read chained to credential theft and command injection [E3](https://bugbountylibrary.com/r/h1%3A696276.md)
- URL normalization traversal exposing file-listing endpoint unauthenticated [E4](https://bugbountylibrary.com/r/h1%3A694865.md)

## Impact and severity
High to critical: arbitrary file read, credential disclosure, and full RCE in the strongest cases [E1](https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md)[E3](https://bugbountylibrary.com/r/h1%3A696276.md). Severity rises when the read is pre-auth [E3](https://bugbountylibrary.com/r/h1%3A696276.md)[E4](https://bugbountylibrary.com/r/h1%3A694865.md), when cleartext credentials are stored [E3](https://bugbountylibrary.com/r/h1%3A696276.md), or when the read chains to code execution [E1](https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md). Blind oracles still leak sensitive files [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-leaking-file-contents-with-a-blind-file-oracle-in-flarum.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md
- E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-leaking-file-contents-with-a-blind-file-oracle-in-flarum.md
- E3: https://bugbountylibrary.com/r/h1%3A696276.md
- E4: https://bugbountylibrary.com/r/h1%3A694865.md