Where is the vulnerability in the PHP script?

Question

PHP

The Bitrix scanner writes that there is a vulnerability here, what is the vulnerability?

$page = basename($_GET['page']);
if (file_exists("pages/$page.php")) include("pages/$page.php");

Answer 1

PHP include - remote inclusion of a PHP file

Answer 2

You absolutely do not check the data that came from the user. You probably do not have an arbitrary list of possible pages, you can do scandir and check if the requested page exists.
Relative paths are not checked at all, that is, technically, you can request the file "pages/../../../../upload/word.php', and you can put the file in the upload folder in many ways (and not all of them from admins).

Answer 3

The vulnerability is that the page you include may contain malicious code.

Answer 4

Through this, you can still delve into the files, at least find out which ones exist in the same directory.
And you can connect something interesting.
The most normal option is to check the allowed values ​​​​on the white list, and not connect anything.