The vulnerability stems from improper path validation when handling asset requests. While no patch code is provided, the description explicitly states that specially crafted GET requests with directory traversal sequences in the asset-pipeline context lead to arbitrary file exposure. In Grails asset-pipeline architecture, the Filter->Service->ResourceLocator chain is responsible for processing asset requests. The confidence is medium because we're inferring based on vulnerability patterns rather than explicit patch analysis. These functions represent the most probable locations where path traversal checks would be missing in vulnerable versions, given their role in request handling and resource resolution.