The vulnerability centers on improper file element handling in XmlReader when location context is missing. The JIRA ticket SLING-2512 explicitly addresses this by restricting file element usage, indicating the read method (or equivalent XML processing entry point) in XmlReader was responsible for unsafe file operations. As the content loader's XML parsing entry point, this function would appear in stack traces when processing malicious imports attempting to load local files.