The vulnerability exists due to a flaw in the Go programming language's OS package, where the Root function fails to properly restrict access to parent directories. This allows processes with root privileges to bypass intended directory boundaries and access parent directories, violating expected security constraints.