The vulnerability stems from the file upload handler in SettingsController.php which lacked SVG content validation. The GitHub patch specifically adds a check for <script> tags in SVG files within this function, indicating it was the entry point for unsafe uploads. The CWE-434 classification confirms this is an unrestricted dangerous file type upload issue, and the commit diff directly modifies this function to implement security checks.