The vulnerability stems from insecure directory permission handling in SpawningKit's process spawning logic. The Phusion blog explicitly mentions SpawningKit improvements including 'symlink-resistant I/O operations' and validation that sockets must be created within secure subdirectories. The CVE description directly implicates directory writability checks during socket path creation. While exact function names aren't provided in public advisories, the SpawningKit component's responsibility for instance directory/socket management and the described fixes (e.g., path validation, fchmod usage) strongly indicate vulnerabilities in these core directory/socket setup functions.