The vulnerability stems from the SecurityExtension class's Twig filter implementations (map, filter, reduce, sort). These functions validated only string-based callables against an allow list, but failed to check array-based callables (e.g., [ClassName, 'method']). This allowed attackers to bypass the allow list by crafting array-format PHP closures, leading to arbitrary code execution. The STAR Labs report demonstrates concrete exploitation via these filters using static method calls (e.g., CacheValueCompressor::uncompress, VarDumper::setHandler), confirming the vulnerability pattern. The functions' code structure (checking only is_string) and the documented bypass methods justify high confidence.