Destination validation normalizes literal backslashes before percent-decoding the request path. This allows a path containing encoded backslashes and dot-segments to bypass the dot-segment check. If the upstream server treats a backslash as a path separator, the forwarded request can escape the configured proxy prefix to access sibling locations on the upstream. An unauthenticated remote attacker can exploit this to retrieve resources outside the intended prefix, impacting confidentiality.