global.php in YaPiG 0.92b allows remote attackers to include arbitrary local files via the BASE_DIR parameter.
NVD-CWE-Other