The vulnerability stems from insufficient ZIP file validation during imports. The key evidence is in the commit diff:- The function 'get_contents_from_bundle' in utils.py was modified to add 'check_is_safe_zip(bundle)' at the start.- This new security check (added in utils/core.py) validates maximum file size (100MB) and compression ratio (200:1) to prevent ZIP bombs.- The absence of this validation in vulnerable versions allowed attackers to upload malicious ZIPs that would trigger excessive resource consumption during decompression/processing.- The affected code path is explicitly used for importing databases/dashboards/datasets via ZIP uploads, which matches the vulnerability description.