The vulnerability stems from unvalidated filename handling in Stashed File Parameters. The commit diff shows critical changes where filename assignment was moved to a setFilename() method that performs Jenkins.checkGoodName() validation. The vulnerable versions directly used FileItem.getName() without validation in StashedFileParameterValue constructor and Base64FileParameterValue.setFile. The AbstractFileParameterDefinition.createValue method was vulnerable as it propagated these unvalidated filenames into the build environment. The high confidence comes from explicit path traversal prevention being added in the patch through filename validation.