diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
index 2afc48fbe3a..ec3a84c1ce2 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
@@ -1418,7 +1418,12 @@ public String makeLink(HttpServletRequest request, HttpServletResponse response,
 
         //If required by webSite parameter, surcharge control path
         if (webSiteProps.getWebappPath() != null) {
-            String requestPath = request.getServletPath();
+            // Derive servlet path from the trusted _CONTROL_PATH_ request attribute (set by ControlServlet)
+            // rather than calling getServletPath() directly on the request, to avoid relying on user-influenced input.
+            String contextPath = request.getContextPath();
+            String requestPath = controlPath.startsWith(contextPath)
+                    ? controlPath.substring(contextPath.length())
+                    : controlPath;
             if (requestPath == null) requestPath = "";
             if (requestPath.lastIndexOf("/") > 0) {
                 if (requestPath.indexOf("/") == 0) {