PHP remote file include vulnerability in Yawp library 1.0.6 and earlier as used in YaWiki and possibly other products allows remote attackers to include arbitrary files via the _Yawpconf_path parameter.