CVE-2018-12536

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using
default Error Handling, when an intentionally bad query arrives that
doesn’t match a dynamic url-pattern, and is eventually handled by the
DefaultServlet’s static file serving, the bad characters can trigger a
java.nio.file.InvalidPathException which includes the full path to the base
resource directory that the DefaultServlet and/or webapp is using. If this
InvalidPathException is then handled by the default Error Handler, the
InvalidPathException message is included in the error response, revealing
the full server path to the requesting system.