Eclipse Jetty can be configured to forward incoming requests to template URIs that embed the request path as a query parameter. When the path includes reserved URI characters such as '&', the forwarded template is parsed as multiple query parameters. Attackers can intentionally craft URLs with these characters to inject arbitrary parameters, potentially changing server behavior or exposing sensitive data. Because the server then processes the injected parameters as part of the request, the vulnerability allows the attacker to manipulate the request without additional authentication, leading to a moderate impact on request integrity and data access.

The issue affects the Eclipse Jetty Server and the Jetty EE servlet modules (EE8, EE9, and EE10). It is triggered when the TryPathsHandler or TryFilesFilter is enabled with a template that inserts the raw path. The advisory does not specify affected version ranges, so any installation using the vulnerable configuration is susceptible.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a crafted HTTP request containing reserved URI characters; no local privilege escalation or network compromise is required. Given the low exploitation probability, the risk is moderate but should be addressed promptly if the vulnerable configuration is in use.