It usually appears when a script builds a file path from a request value without strict validation. Depending on the flaw, it can reveal configuration files containing credentials or, in some situations, lead to code execution.
Defenders may see requests containing directory traversal patterns or references to sensitive system files in web logs. Such entries show attempts, not success, so look at the response sizes and codes and at other activity from the same source.
Patch the affected software first. Defense in depth helps as well: validate paths against allow-lists, restrict file permissions, use open_basedir, and keep secrets out of web-readable locations.