The vulnerability stems from the remote_static endpoint handling file requests. Prior to the patch, it directly used request.args.get('file') as input for send_file without proper path validation or authentication checks. The GitHub advisory explicitly mentions the send_file call as the root cause, and the patch adds session-based authorization checks and path validation. The CWE-22/36 mapping confirms this is a path traversal vulnerability enabled by improper input sanitization in file handling functions.