The vulnerability stems from improper file extension validation during rename operations in the DMS/ECM module. The core issue appears in functions handling file metadata updates: 1) The Document::rename function is a prime candidate as it would directly handle filename changes while lacking extension validation. 2) ECM::updateFile is included with medium confidence as it might be responsible for persisting file metadata changes. Both would interact with the 'Setup documents directories' permission but fail to properly enforce the .noexe protection when processing filename modifications, enabling XSS payloads through crafted extensions.