claroline versions 180rc1 and prior suffer from remote file inclusion vulnerabilities in $includePath.