An incomplete blacklist in the .htaccess sample of WWBN AVideo 14.4 and the dev master commit 8a8954ff allows specially crafted HTTP requests to potentially execute arbitrary code. The vulnerability can be triggered by requesting a .phar file, which bypasses the blacklist restrictions.