The vulnerability stems from improper handling of the 'file' parameter in document.php. The commit diff shows critical changes where $original_file (derived from user input) was replaced with $fullpath_original_file after security checks. Pre-patch versions lacked adequate validation for directory traversal patterns (../) and dangerous characters, allowing attackers to disclose sensitive files by manipulating the file parameter. The code directly used user input to build filesystem paths without proper normalization, matching the CWE-200 exposure pattern.