The primary vulnerability existed in FormBuilder::doBuildForm, where the lack of input sanitization after detecting an invalid CSRF token allowed attackers to submit malicious payloads. The patch explicitly resets user input, POST data, and file uploads, confirming this was the root cause. The FormValidator::setInvalidTokenError's message adjustment (removing the reload link) suggests a secondary mitigation, though its direct impact on the vulnerability is less critical. Test cases in the commit diff validate() that form values were retained pre-patch, confirming the exploit path.