The vulnerability stems from the script's handling of the PIPELINE_PATH variable. The pre-patch code (shown in the diff) directly executed '/bin/chown -R' on the constructed path without checking for symlinks. The patch added critical validations: 1) realpath check to prevent symlink resolution, 2) directory existence check, and 3) early exit for non-existent paths. The vulnerable code path was the unconditional chown execution after basic existence check, which didn't account for symlink manipulation. The script's sudo permissions made this particularly dangerous as it could be exploited for privilege escalation.