The vulnerability stems from FileCache initialization in cache.py using tempfile.gettempdir() + '/suds' when no location is specified. This creates a predictable path in world-writable /tmp, allowing symlink attacks. The init method's logic for setting self.location (lines 140-142 in original code) directly implements this vulnerable pattern. Runtime detection would show this constructor being called when processing SOAP requests, making it the primary indicator.