The vulnerability stems from improper neutralization of SVG file inputs during upload processing. All three controller methods handled file uploads by directly storing file contents without SVG-specific sanitization. The patch introduced SVG sanitization using enshrined/svgSanitize, indicating these functions previously lacked proper input validation. The XSS risk occurs when browsers render malicious SVG scripts stored through these endpoints. The affected code paths are clearly shown in the pre-patch diffs where SVG handling lacked sanitization.