include/require with a variable path enables local or remote file inclusion.
Include only from a fixed whitelist of allowed files; never use raw user input in paths.