The vulnerability stems from improper URI parsing that allows semicolons to bypass path restrictions. Resin's request handling (e.g., UrlDispatcher.service and WebApp.handleRequest) likely processes URIs without properly normalizing or sanitizing semicolons, treating them as valid path separators. This aligns with the attack vector examples (e.g., '/resin-doc/;/WEB-INF/resin-web.xml'), where the semicolon tricks the server into traversing directories. These functions are core to URI resolution in Resin, making them high-confidence candidates.