The vulnerability stems from improper file extension validation during avatar uploads. The PoC demonstrates that attackers can upload a PHP file by manipulating the filename in the request (e.g., 'php.jpg.php'). This indicates the backend fails to properly sanitize or validate the final extension after processing the filename. The handleFileUpload function (or similar) in the user settings controller is responsible for processing uploads, and its lack of strict extension checks allows dangerous file types to be stored. The high confidence comes from the reproducible exploit steps and the CWE-434 classification, which directly points to unrestricted file upload handling.