The vulnerability stemmed from insufficient file type validation during profile picture uploads. The commit patching this vulnerability added a 'verify_type' method to check MIME types and content categories. The original 'upload' function in uploader.py (called during user/group creation in create.py) did not perform these checks in vulnerable versions, allowing SVG files with embedded scripts. The tests added in test_create.py demonstrate that non-image uploads were previously allowed without validation.