The vulnerability stems from how Sanic's static file handler processes URL paths. The _static_request_handler in routes.py initially checked for '../' in the raw URL path but did not properly handle URL-decoded paths containing '%2F' (encoded slashes). This allowed lateral directory traversal when the URL was unquoted. The patch in PR #2495 modified this handler to check the decoded URI for traversal patterns, confirming this as the vulnerable function. The file path and function name are evident from the commit diff analysis and the security advisory context.