The vulnerability stemmed from insufficient path validation in three key areas: (1) WebappClassLoader's resource extraction allowed JAR entries to escape the loader directory via path traversal, (2) ExpandWar's WAR expansion did not enforce docBase boundaries, and (3) HostConfig's WAR filename-to-context-path mapping permitted directory traversal sequences. The commit explicitly adds canonical path checks (e.g., startsWith(canonicalLoaderDir)) and filename validation to address these flaws, confirming these functions were the vulnerable points.