The vulnerability stems from improper error handling and input validation across multiple components. The patches explicitly address: 1) Type checks in openid.php, 2) Missing config.php directory handling, 3) Array parameter processing in FormDisplay (libraries/config/FormDisplay.php), 4) Input validation gaps in Validator class (libraries/config/Validator.php), and 5) Unsanitized error messages in validate.php. Each vulnerable function allowed unhandled exceptions/errors to leak full path information when receiving malformed inputs, as confirmed by the commit diffs and CVE description.