The vulnerability stems from insecure XML parsing in the GSA XML file parser. The GitHub issue (#1851) and 0dd.zone report explicitly point to AdminBackupAction.java triggering GsaConfigParser.parse() for GSA XML files. While AdminBackupAction.java is the entry point, the root cause is in GsaConfigParser's implementation. The use of SAXParserFactory without disabling external entities (as indicated in the GitHub issue description) directly enables XXE. The confidence is high because multiple sources confirm the GSA parser's role, and XXE vulnerabilities in SAXParser are well-understood in this context.