The request path doesn't get displayed unescaped in the 404 page does it? Else this could be a vulnerability like https://issues.sonatype.org/browse/NEXUS-6554