Invalid URL esc-symbols decoding allows user to access protected directory.
vulners.com/securityvulns/securityvulns:doc:6263