The vulnerability stems from improper path validation in snapshot metadata handling. The critical function is createSnapshot in SnapshotsService, which was modified in the patched version to add FileSystemUtils.isSubPath() checks. This indicates the pre-patch version allowed writing metadata files outside repository directories. The function would appear in stack traces during snapshot creation attempts and would process attacker-controlled file paths.