The reason it's doomed to failure is because WAFs operate before your application, and don't have any clue what the data is. Here is a WAF matching line: https

The reason it's doomed to failure is because WAFs operate before your application, and don't have any clue what the data is. Here is a WAF matching line: https://github.com/coreruleset/coreruleset/blob/943a6216edea83e4656f6f8b19311ec504f58a3e/rules/lfi-os-files.data#L331 https://github.com/coreruleset/coreruleset/blob/943a6216edea... Here's where that file is loaded: https://github.com/coreruleset/coreruleset/blob/943a6216edea83e4656f6f8b19311ec504f58a3e/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf#L99 https://github.com/coreruleset/coreruleset/blob/943a6216edea... It's loaded with '"@pmFromFile lfi-os-files.data"' which means "case-insensitive match of values from a file". So yeah, the reason it can't resolve paths properly is because WAFs are just regex and substring matching trying to paper over security issues in an application which can only be solved correctly at the application level.