 files on the current server can be included for execution.This issue can still lead to remote code execution by including a file that contains attacker-controlled data such as the web server's access logs.In PHP the main cause is due to the use of unvalidated user-input with a filesystem function that includes a file for execution.