The vulnerability stemmed from using string-based path comparisons (getCanonicalPath().startsWith()) rather than proper Path object comparisons. This could allow bypassing directory containment checks via symlinks, case variations, or filesystem-specific path representations. The commit 6d66e99 explicitly replaces these vulnerable string comparisons with java.nio.file.Path comparisons in multiple files, indicating these were the vulnerable functions. The files shown in the diff (DefaultServlet.java, FileStore.java, HostConfig.java etc.) all contained this pattern and were patched by switching to Path-based checks.