The issue arises from improper restriction of access to other directories when the open basedir directive includes a trailing slash. This allows PHP scripts in one directory to access files in other directories whose names are substrings of the original directory.