The vulnerability stems from improper synchronization in DirResourceSet's locking mechanism. The commit diff shows missing resourceLocksByPath.put() calls when creating new ResourceLocks, allowing concurrent threads to bypass file state checks. This enabled race conditions where an attacker could replace a checked file (e.g., .jsp) with malicious content before compilation. The case-insensitive filesystem aspect exacerbates this by allowing case-variant file replacement. The patch adds the missing put() operations to ensure lock visibility across threads, directly addressing the TOCTOU gap.