PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2 and earlier when register_globals is enabled allows remote attackers to execute arbitrary PHP code via a FTP URL or full file path in the Pathsextensions_path parameter.