The issue is related to an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability. This allows a remote attacker to execute arbitrary code by injecting a specially crafted URL. The vulnerability has been exploited in real-world attacks, with one of the attackers being the Mirai botnet. The exploitation is relatively simple, involving the addition of a semicolon (;) after a public URL, followed by a private URL that the attacker wishes to access. This can bypass authentication and allow code execution on the server.