The vulnerability stems from insecure handling of uploaded images where EXIF data was not stripped. The patch in commit b592c86 modifies the image processing logic in plupload.php to explicitly re-save images using GD library functions (imagejpeg/imagepng/imagegif), which creates new images without EXIF data. The presence of these functions in the code without proper execution or implementation in versions <1.3 indicates the vulnerability. The diff shows the same GD functions were present but lacked the critical EXIF-stripping behavior before the patch, likely due to missing logic paths or improper configuration.