The XSS occurs when filenames containing JavaScript are rendered unsafely in the DOM. The Snyk PoC demonstrates this by triggering an alert via an <img onerror> payload in the filename. The vulnerability pattern matches unsafe DOM manipulation methods like innerHTML/innerText without escaping, which would exist in the file-list rendering logic. While the exact function name isn't visible without source code, the file upload UI component (pekeUpload.js) must contain this insecure rendering logic based on the exploit mechanism and references to similar plupload code.