The vulnerability stems from the TemplateController's template() method which takes a user-supplied template name and passes it directly to Twig's render() function. The code comment explicitly warns this isn't routed by default due to security risks. Attackers with theme editing privileges can create malicious templates containing Twig code (like the PoC's {{[...]|filter('system')}} payload), which gets executed when the template is rendered. The lack of input sanitization and unsafe rendering of user-controlled template files creates the code injection vector. The provided exploit demonstrates this leads to RCE through Twig's template execution capabilities.