The vulnerability stems from missing path validation in key project management functions. The commit diff shows critical security checks were added to these functions using fspath.relative() with regex patterns to prevent '../' sequences. Specifically:

1. getFile() lacked path validation before file access
2. update() accepted user-controlled file paths without validation
3. loadProject() allowed project names with path traversal sequences These functions directly handled user-supplied path parameters and were the entry points for the path traversal vulnerability, as evidenced by the security patches that added validation checks to these exact locations.