The issue is related to the lack of checking for `%00` sequences in path names, which can be exploited by a remote attacker to read or write to arbitrary files. This can be achieved by providing specially crafted input to an application that uses the `DOMDocument` save method or the `GD` `imagepsloadfont` function. For example, an attack using a filename like `filename0.html` could bypass intended configuration restrictions, such as only allowing clients to write to `.html` files.