The vulnerability stems from how the 'lang' parameter was processed. The pre-patch code used basename($GET['lang']) to sanitize input, but PHP's basename() is ineffective against null-byte injection (e.g., '../../etc/passwd%00' becomes '../../etc/passwd' after URL decoding, and the null byte truncates the string internally). When combined with file_exists(), this allowed checking for files outside the intended directory. The patch replaced this flawed sanitization with a regex filter ([A-Za-z-]), confirming the original functions were the vulnerability source.