PHP remote file inclusion vulnerability in CheckUpload.php in Vincenzo Valvano Comet WebFileManager (CWFM) 0.9.1 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the Language parameter.