The vulnerability stems from the plugin's use of a patched fork of Jenkins' DirectoryBrowserSupport class that lacked the SECURITY-2481 fix. This fix in core Jenkins addressed path traversal via absolute paths on Windows. The plugin's fork would have contained modified versions of key path-handling methods like serveFile() (for file serving) and resolvePath() (for path validation). These functions failed to account for Windows absolute path syntax (e.g., 'C:'), allowing attackers to escape restricted directories. The high confidence comes from the explicit advisory mention of the missing SECURITY-2481 fix and the Windows-specific path interpretation flaw.