The analysis of the vulnerability was based on the detailed description provided, the referenced exploit from Exploit-DB, and the Metasploit module. The core of the vulnerability is a lack of input sanitization in the user profile's displayname field, which is handled by Bolt\Controller\Backend\Users::save(). This allows for the initial code injection. The vulnerability is escalated by other weaknesses in the system, specifically the ability to list session files using Bolt\Controller\Async\Browse::browse() and the ability to rename and move these files into a web-accessible directory using Bolt\Controller\Async\FilesystemManager::rename(). This chain of vulnerabilities allows an authenticated user to achieve remote code execution. The identified functions are the key components that enable this attack.