Vanilla could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request to the definitions.php script using the include or Configuration['LANGUAGE'] parameter to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server. *CVSS: Base Score: 7.5 Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial Temporal Score: 6.1 Exploitability: Unproven Remediation Level: Unavailable Report Confidence: Uncorroborated Consequences: Gain Access