The vulnerability stems from how the 'gcov-root' parameter is handled in command construction. The commit diff shows the vulnerable code used validator.escape() for sanitization, which doesn't prevent command injection via operators like '&'. The patch introduced a custom sanitizeVar function to remove ampersands, confirming the attack vector. The exec function executes the constructed command string containing user-controlled input, making the upload function the primary vulnerable point.