The vulnerability exists in how Jetty's JspServlet handles filenames containing XSS payloads with encoded linefeeds. The service method of JspServlet is the entry point for processing .jsp requests and would be responsible for handling the filename parameter from the URI. In vulnerable versions, this method likely directly used the filename in HTML responses without proper sanitization, allowing script injection when the filename contains %0a characters. The confidence is medium as we're inferring based on vulnerability description patterns rather than explicit patch code.