The vulnerability stems from the pre-patch code in django.views.static.serve() which contained path normalization logic followed by an HttpResponseRedirect if the path was modified. This allowed attackers to manipulate the 'path' parameter to create open redirects. The commit diff shows removal of the redirect logic and replacement with safe_join(), confirming this was the vulnerable code path. The CVE description explicitly references this function as the attack vector.