** DISPUTED **  PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: this issue has been disputed by third parties who state that contentpublisher.php protects against direct request in the most recent version.  The original researcher is known to be frequently inaccurate.