The vulnerability stems from insufficient sanitization in the TeX notation filter. The commit reference MDL-84136 and patch context mention improvements to 'filter_tex' sanitization. Moodle's TeX filter (filter_tex::filter in filter/tex/filter.php) handles user-provided TeX content and passes it to pdfTeX. Prior to patching, it likely failed to properly sanitize commands that enable arbitrary file inclusion (e.g., \input{/etc/passwd}). This matches the CWE-552 pattern of exposing files via external command execution. The confidence is high due to the direct correlation between the vulnerability description, CWE type, and the filter_tex component explicitly mentioned in the commit reference.