Directory traversal vulnerability in PHPList 2.10.2 and earlier allows remote attackers to include arbitrary local files via the (1) GLOBALSdatabase_module or (2) GLOBALSlanguage_module parameters which overwrite the underlying $GLOBALS variable.