The vulnerability occurs because the query string is included unescaped in error messages generated by the request handler. In Apache Struts 1.x, the RequestProcessor class is responsible for processing requests and generating errors. Its process() method validates actions and parameters, and when invalid inputs are detected (e.g., non-existent actions), it constructs error messages using the raw request URI (including the query string). Since the query string is not HTML-encoded in these error messages, it allows XSS payloads to execute. This aligns with the CWE-80 description and the vulnerability's root cause described in the advisory.