The vulnerability stems from express-hbs's handling of the 'layout' parameter in the Express render API. When applications pass user-controlled data (e.g., req.query) to res.render, attackers can inject a 'layout' value pointing to arbitrary files. The engine resolves this parameter to read files from disk (with existing extensions) or appends .hbs to extensionless paths. The commit diff and advisory explicitly warn about this pattern, and the CWE-200/CWE-94 mappings confirm improper input validation and information exposure. While the exact internal function name isn't visible in provided data, the core issue manifests in the layout handling logic during rendering.