The vulnerability stems from using unsanitized X-Scope-OrgID values in file path construction. The ruler component's rule group synchronization logic (SyncRuleGroups) directly used tenant IDs to build filesystem paths. Since Loki's ruler inherits from Cortex's implementation, and the fix involved updating Cortex's tenant ID validation, the vulnerable function would be in the rule management logic that handles tenant-specific paths. The description explicitly mentions rules file path construction as the attack vector, aligning with the ruler component's responsibilities.