The vulnerability stems from Plone's ReStructuredText transformation utility improperly handling user-controlled keyword arguments. The transform passes these arguments directly to docutils' publish_parts function, which supports parameters that control file output locations. Authenticated managers could craft arguments like 'output' to write arbitrary files. The hotfix addressed this by restricting allowed parameters. The convert method in the restructuredtext transform is the entry point for this processing, making it the clear vulnerable function.