The vulnerability is explicitly tied to the backend/Login/load endpoint, which maps to the loadAction method in Shopware's MVC architecture. The CWE-20 (Improper Input Validation) and RCE nature of the exploit strongly suggest unsafe deserialization of user input. While the exact code isn't visible, the commit d73e903 referenced in advisories likely patched this controller method by adding validation or removing dangerous deserialization. This pattern matches common PHP object injection vulnerabilities where unserialize() is used with untrusted data.