MamboWiki, the Mambo/Joomla CMS component, versions 0.9.4 and below suffer from a remote file inclusion vulnerability.