The vulnerability stems from the file_put_contents call in SImExporter::import which used unsanitized user input from $_data to construct a file path. The original code extracted a filename from $_data without removing directory traversal sequences ('../'), enabling attackers to write files outside the intended directory. The patch explicitly adds str_replace('../', '', ...) to mitigate this, confirming the lack of path traversal sanitization was the root cause. The function's role in handling file imports and the direct use of untrusted input make it clearly vulnerable.