I just found a few articles regarding a remote file include injection. I would like to confirm this is NOT true, and is within BBCodePress, which is NOT used at all within eoCMS, that was merely made as a possible base for the replacement of the MarkItUp! editor.

These articles also states it requires register_globals to be enabled, eoCMS automatically reverses this so it would not be possible if bbcodepress was integrated fully