PHP world-writable files: chmod 0777, 0666 or umask(0)
Rule ID: vetkit.php.file-permissions.world-writable
A file or directory is made world-writable (chmod 0777 / 0666, or umask(0), which makes every file the process creates world-writable). Any local user or co-hosted application can replace its content; for a PHP script or configuration file that is code execution.
Last updated:
Suite: Security
php
A file or directory is made world-writable (chmod 0777 / 0666, or umask(0), which makes every file the process creates world-writable). Any local user or co-hosted application can replace its content; for a PHP script or configuration file that is code execution.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Use 0644 / 0755 (or 0640 / 0750) and give the web-server user ownership of what it must write instead of opening it to everyone; do not call umask(0).
References
Source: packages/engine/rules/sast/php.yml.
Related checks
- PHP loose == hash comparison: type juggling auth bypass
- PHP strcmp() == 0 on request input allows auth bypass
- PHP unsafe reflection: class or method from request input
- PHP code injection: function name from request input
- PHP eval() code injection with non-literal value
- PHP command injection: OS command from request input
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.