On an apache webserver with multiple VirtualHosts running different PHP websites on different domains, how important is it to set open_basedir for each VirtualHost?

Will it actually help to isolate the different VHosts from each other or is it possible to circumvent the restriction?

How big of a security flaw is it to not set open_basedir under the described circumstances?

2 Answers 2


It adds additional protection in case of a directory traversal vulnerability. For example, consider a PHP file that looks like this:


Without open_basedir, this page could be used to read any file on the filesystem. Setting open_basedir prevents this, so that only files in some specific directory can be read.

However, open_basedir does not protect against someone that can run (PHP) code on the server. For example, simply running system('cat /etc/passwd') will bypass the basedir setting. Also, not all functions that handle files check the path against the open_basedir setting.


open_basedir basically limits operations to a userspace, a directory in the filesystem namely their home directory. You can set it to multiple directories if needed.

setting open_basedir prevents accessing/modifying a location outside of the specified space be it intentional or accidental.

If there is a vulnerability in a PHP script or malicious php scripts in the userspace, it limits the malicious script access to the directory/directories. Making it difficult for them to pull files like passwd, shadow files or any other sensitive areas.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .