The vulnerability stems from how security checks were handled in the include() function. The original implementation (pre-patch) checked security during template preparation via a loop that only validated Template/TemplateWrapper instances. When including templates by name (not instances) that had been cached without sandbox context, these checks were skipped. The commit diff shows the security check (checkSecurity()) was moved from the preparation phase to the runtime phase after template loading, ensuring enforcement regardless of how the template was referenced. The test cases added in CoreTest.php validate that security errors now occur at runtime when preloading occurs, confirming the function's behavior was the root cause.