The vulnerability stems from two key issues:

1. Component.findValue's unconditional OGNL evaluation when altSyntax was enabled, without verifying if the input actually contained an expression.
2. ComponentUtils.isExpression's strict '%{...}' boundary check, which failed to detect expressions mixed with other text (e.g., 'foo%{bar}').

These functions together allowed attackers to inject OGNL expressions via tag attributes that would be evaluated twice - first during attribute processing, then again during rendering. The patch added ComponentUtils.containsExpression to detect partial expressions and modified findValue to use this check, preventing the double evaluation.