The vulnerability stems from two key points: 1) ConfController.java's find() method accepts user-controlled 'keys' parameter via HTTP request and passes it to downstream processing without path normalization. 2) PropUtil.java's loadFileProp() method uses these keys directly in file path construction (new File()) without validation. The combination allows attackers to inject '../' sequences to escape the intended configuration directory. Both functions are explicitly referenced in vulnerability reports and the code structure matches the described exploit flow.