A flaw in code is only dangerous if an attacker can get input to it. The exploit path describes the steps: which network address is reachable, which URL is called, whether a login is needed, what data is sent, and what conditions have to be true on the target. A bug that sits in a function used only by a local administrator has a different path than one in a page that anyone can request.
Mapping the path tells you how urgent a vulnerability is for you. If the vulnerable component is not reachable from the internet, or needs credentials that attackers do not have, the practical risk is lower, although you should still patch.
It also shows where to cut. You can break a path by removing exposure, requiring authentication, restricting by IP address, disabling the feature, or filtering the request at a proxy. These are mitigations, and each addresses one path while the flaw remains.
Read advisories for the conditions of exploitation, and check each one against your own setup.