The vulnerability stems from insecure XML parsing in the ReadXML class's call() method. The pre-patch code used DocumentBuilderFactory.newInstance() without security hardening, leaving XXE protections disabled. The commit diff shows the vulnerability was fixed by: 1) Introducing a createFactory() method that disables dangerous XML features 2) Setting secure processing attributes 3) Adding a null EntityResolver. The original implementation lacked these protections, making the call() method the vulnerable entry point for XXE attacks when processing XML files with the ${XML} macro.