The vulnerability title and CVE description explicitly name drupal_goto as the vulnerable function. The core issue stems from its handling of the 'destination' parameter - it performs a single rawurldecode() call but fails to account for double-encoded payloads that bypass Drupal's URL validation when PHP's built-in request parameter parsing automatically decodes inputs. This combination allows the redirect protection to be circumvented. The file path is confirmed through Drupal 6's code structure where common utilities like drupal_goto reside in includes/common.inc.