Home/CWE/Inclusion of Functionality from Untrusted Control Sphere
Weakness

Inclusion of Functionality from Untrusted Control Sphere

CWE-829 · Base · Incomplete

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-669 · Incorrect Resource Transfer Between Spheres
Children (more specific)
ParentOfCWE-827 · Improper Control of Document Type Definition
ParentOfCWE-830 · Inclusion of Web Functionality from an Untrusted Source
ParentOfCWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
◆

Attack Patterns (CAPEC)

13
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-175Code Inclusion
CAPEC-201Serialized Data External Linking
CAPEC-228DTD Injection
CAPEC-251Local Code Inclusion
CAPEC-252PHP Local File Inclusion
CAPEC-253Remote Code Inclusion
CAPEC-263Force Use of Corrupted Files
CAPEC-538Open-Source Library Manipulation
CAPEC-549Local Execution of Code
CAPEC-640Inclusion of Code in Existing Process
CAPEC-660Root/Jailbreak Detection Evasion via Hooking
CAPEC-695Repo Jacking
CAPEC-698Install Malicious Extension
⚠

CVEs With This Weakness

259
A sample of the 259 CVEs tagged with this weakness.
CVECVE-2026-7373
CVECVE-2026-6859
CVECVE-2026-6482
CVECVE-2026-6357
CVECVE-2026-45184
CVECVE-2026-44995
CVECVE-2026-44336
CVECVE-2026-44312
CVECVE-2026-43944
CVECVE-2026-43940
CVECVE-2026-43571
CVECVE-2026-43569
◉

Nuclei Scanner Templates

6
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalKibana - Local File Inclusion
highCuppaCMS v1.0 - Local File Inclusion
highCuppa CMS v1.0 - Local File Inclusion
highCuppa CMS v1.0 - Local File Inclusion
highSAS/Internet 9.4 1520 - Local File Inclusion
mediumCuppa CMS v1.0 - Authenticated Local File Inclusion
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin