A remote code execution attack where user input is used to build the path of code files to be executed, allowing an attacker to control which code is executed. Most commonly affects web applications that rely on a scripting run time, most commonly PHP.
Typically this is a Local File Inclusion vulnerability where the attacker can execute or view arbitrary files already present on the server but not upload arbitrary code.
See wikipedia File inclusion vulnerability.
