The vulnerability stems from how the fetch module handles remote file paths. The code in fetch.py used the 'source' parameter from the remote host's slurp response (remote_source) to build destination paths without proper validation. Attackers could supply malicious paths with directory traversal sequences. The GitHub issue (#67793) and commit diff show the fix involved avoiding slurp return values for destination setup and adding path safety checks, confirming the vulnerable pattern was in the destination path construction logic of the fetch action module.