PHP remote file inclusion vulnerability in addon_keywords.php in Keyword Replacer (keyword_replacer) 1.0 and earlier a module for miniBB allows remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter.