PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1 with register_globals enabled allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSsrcdir parameter.