The vulnerability root cause lies in two key areas:

1. In GlobalVars.php, the canonicalUrl was directly configured with a Twig template that incorporated user-controlled pathInfo. This allowed attackers to inject Twig code via crafted URIs.
2. In DynamicMeta.php's getLocalizedUrls method, the URL processing lacked critical sanitization steps (query string stripping and protocol enforcement), enabling the injected Twig code to execute. The patch explicitly addresses both points by replacing the dynamic Twig template with a safe helper method and adding sanitization layers in the URL generation logic.