CWE-98 is a weakness category for unsafe control of filenames used by PHP include or require logic. It describes cases where application data can influence which file is loaded, instead of the program choosing from a fixed, trusted set.
This matters because file-inclusion bugs can become more than a read issue. If an attacker can steer path handling, they may trigger local file inclusion, traverse out of an intended directory, or force execution of a malicious or unintended PHP file. In CMS platforms and templating systems, that can turn normal routing or page selection into a code-execution path when server conditions line up.
Defenses focus on removing path ambiguity: use allowlists of known template names, map inputs to fixed filenames, canonicalize paths before use, and verify that resolved files stay inside an approved directory. Avoid building include paths from raw request data, and apply least-privilege permissions so even a bad file choice cannot expose sensitive code.