The vulnerability stems from improper file extension validation. The commit diff shows critical changes to AttachmentModel::upload (added $check_filename parameter) and AttachmentModel::isAllowedFilename (removed .webmv/.swf). The upload() function's unconditional filename check in vulnerable versions, combined with isAllowedFilename()'s permissive allow-list, enabled malicious file uploads. The .webma extension mentioned in the advisory may reflect a discrepancy (e.g., typo) or an unobserved code path, but the structural weakness in these functions is clear.