The vulnerability stems from improper path sanitization in the configuration update handler. The original code (pre-patch) used a simple string replacement to remove '../' sequences, which is insufficient to prevent path traversal attacks. This logic was located in phpmyfaq/admin/configuration.php where user-supplied attachment path values were processed. The commit diff shows the vulnerable pattern replacement was replaced with realpath() validation and document root comparison, confirming this was the vulnerable code path. While no named function is explicitly shown, the procedural code handling configuration updates for 'records.attachmentsPath' directly enabled the traversal vulnerability through inadequate sanitization.