diff --git a/typo3/sysext/core/Classes/Core/SystemEnvironmentBuilder.php b/typo3/sysext/core/Classes/Core/SystemEnvironmentBuilder.php
index e198fa136f5a8b434c543a754f84e1838a378698..9d2dc8ab53d34f210941d54bbcede839a291f1c0 100644
--- a/typo3/sysext/core/Classes/Core/SystemEnvironmentBuilder.php
+++ b/typo3/sysext/core/Classes/Core/SystemEnvironmentBuilder.php
@@ -264,23 +264,17 @@ class SystemEnvironmentBuilder
     }
 
     /**
-     * Calculate path to entry script if not in cli mode.
-     *
-     * Depending on the environment, the script path is found in different $_SERVER variables.
+     * Return path to entry script if not in cli mode.
      *
      * @return string Absolute path to entry script
      */
     protected static function getPathThisScriptNonCli()
     {
-        $isCgi = Environment::isRunningOnCgiServer();
-        if ($isCgi && Environment::usesCgiFixPathInfo()) {
-            return $_SERVER['SCRIPT_FILENAME'];
-        }
-        $cgiPath = $_SERVER['ORIG_PATH_TRANSLATED'] ?? $_SERVER['PATH_TRANSLATED'] ?? '';
-        if ($cgiPath && $isCgi) {
-            return $cgiPath;
+        if (Environment::isRunningOnCgiServer() && !Environment::usesCgiFixPathInfo()) {
+            throw new \Exception('TYPO3 does only support being used with cgi.fix_pathinfo=1 on CGI server APIs.', 1675108421);
         }
-        return $_SERVER['ORIG_SCRIPT_FILENAME'] ?? $_SERVER['SCRIPT_FILENAME'];
+
+        return $_SERVER['SCRIPT_FILENAME'];
     }
 
     /**
diff --git a/typo3/sysext/core/Classes/Http/NormalizedParams.php b/typo3/sysext/core/Classes/Http/NormalizedParams.php
index 938ccf7f40d2f2d03e4e47d0662d4e4ac33a583c..8441e34c43eaad2e7e02824f85e915f43249d9f0 100644
--- a/typo3/sysext/core/Classes/Http/NormalizedParams.php
+++ b/typo3/sysext/core/Classes/Http/NormalizedParams.php
@@ -308,12 +308,13 @@ class NormalizedParams
         $requestHost = $this->requestHost = ($isHttps ? 'https://' : 'http://') . $httpHost;
         $requestHostOnly = $this->requestHostOnly = self::determineRequestHostOnly($httpHost);
         $this->requestPort = self::determineRequestPort($httpHost, $requestHostOnly);
-        $scriptName = $this->scriptName = self::determineScriptName(
+        $scriptNameOnFileSystem = self::determineScriptName(
             $serverParams,
             $configuration,
             $isHttps,
             $isBehindReverseProxy
         );
+        $scriptName = $this->scriptName = self::encodeFileSystemPathComponentForUrlPath($scriptNameOnFileSystem);
         $requestUri = $this->requestUri = self::determineRequestUri(
             $serverParams,
             $configuration,
@@ -326,7 +327,7 @@ class NormalizedParams
         $requestDir = $this->requestDir = $requestHost . GeneralUtility::dirname($scriptName) . '/';
         $this->remoteAddress = self::determineRemoteAddress($serverParams, $configuration, $isBehindReverseProxy);
         $scriptFilename = $this->scriptFilename = $pathThisScript;
-        $this->documentRoot = self::determineDocumentRoot($scriptName, $scriptFilename);
+        $this->documentRoot = self::determineDocumentRoot($scriptNameOnFileSystem, $scriptFilename);
         $siteUrl = $this->siteUrl = self::determineSiteUrl($requestDir, $pathThisScript, $pathSite . '/');
         $this->sitePath = self::determineSitePath($requestHost, $siteUrl);
         $this->siteScript = self::determineSiteScript($requestUrl, $siteUrl);
@@ -341,6 +342,11 @@ class NormalizedParams
         $this->queryString = $serverParams['QUERY_STRING'] ?? '';
     }
 
+    private static function encodeFileSystemPathComponentForUrlPath(string $path): string
+    {
+        return implode('/', array_map('rawurlencode', explode('/', $path)));
+    }
+
     /**
      * @return string Sanitized HTTP_HOST value host[:port]
      */
@@ -629,17 +635,7 @@ class NormalizedParams
         bool $isHttps,
         bool $isBehindReverseProxy
     ): string {
-        // see https://forge.typo3.org/issues/89312
-        // When using a CGI wrapper to dispatch the PHP process `ORIG_SCRIPT_NAME`
-        // contains the name of the wrapper script (which is most probably outside
-        // the TYPO3's project root) and leads to invalid prefixes, e.g. resolving
-        // the `siteUrl` incorrectly as `http://ip10.local/fcgi/` instead of
-        // actual `http://ip10.local/`
-        $possiblePathInfo = ($serverParams['ORIG_PATH_INFO'] ?? '') ?: ($serverParams['PATH_INFO'] ?? '');
-        $possibleScriptName = ($serverParams['ORIG_SCRIPT_NAME'] ?? '') ?: ($serverParams['SCRIPT_NAME'] ?? '');
-        $scriptName = Environment::isRunningOnCgiServer() && $possiblePathInfo
-            ? $possiblePathInfo
-            : $possibleScriptName;
+        $scriptName = $serverParams['SCRIPT_NAME'] ?? '';
         if ($isBehindReverseProxy) {
             // Add a prefix if TYPO3 is behind a proxy: ext-domain.com => int-server.com/prefix
             if ($isHttps && !empty($configuration['reverseProxyPrefixSSL'])) {
@@ -775,11 +771,11 @@ class NormalizedParams
     /**
      * Calculate absolute path to web document root
      *
-     * @param string $scriptName Entry script path of URI, without domain and without query parameters, with leading /
+     * @param string $scriptNameOnFileSystem Entry script path of URI on file system, without domain and without query parameters, with leading /
      * @param string $scriptFilename Absolute path to entry script on server filesystem
      * @return string Path to document root with trailing slash
      */
-    protected static function determineDocumentRoot(string $scriptName, string $scriptFilename): string
+    protected static function determineDocumentRoot(string $scriptNameOnFileSystem, string $scriptFilename): string
     {
         // Get the web root (it is not the root of the TYPO3 installation)
         // Some CGI-versions (LA13CGI) and mod-rewrite rules on MODULE versions will deliver a 'wrong'
@@ -787,7 +783,7 @@ class NormalizedParams
         // disturb this as well. Therefore the DOCUMENT_ROOT is always calculated as the SCRIPT_FILENAME
         // minus the end part shared with SCRIPT_NAME.
         $webDocRoot = '';
-        $scriptNameArray = explode('/', strrev($scriptName));
+        $scriptNameArray = explode('/', strrev($scriptNameOnFileSystem));
         $scriptFilenameArray = explode('/', strrev($scriptFilename));
         $path = [];
         foreach ($scriptNameArray as $segmentNumber => $segment) {
diff --git a/typo3/sysext/core/Classes/Utility/GeneralUtility.php b/typo3/sysext/core/Classes/Utility/GeneralUtility.php
index 039384ed3bd5ccb6dcf573ab8522cb1af226c164..b7eb26121d784a4e10bae14c1e84706fc1aec29c 100644
--- a/typo3/sysext/core/Classes/Utility/GeneralUtility.php
+++ b/typo3/sysext/core/Classes/Utility/GeneralUtility.php
@@ -2478,10 +2478,7 @@ class GeneralUtility
         $retVal = '';
         switch ((string)$getEnvName) {
             case 'SCRIPT_NAME':
-                $retVal = Environment::isRunningOnCgiServer()
-                    && (($_SERVER['ORIG_PATH_INFO'] ?? false) ?: ($_SERVER['PATH_INFO'] ?? false))
-                        ? (($_SERVER['ORIG_PATH_INFO'] ?? '') ?: ($_SERVER['PATH_INFO'] ?? ''))
-                        : (($_SERVER['ORIG_SCRIPT_NAME'] ?? '') ?: ($_SERVER['SCRIPT_NAME'] ?? ''));
+                $retVal = $_SERVER['SCRIPT_NAME'] ?? '';
                 // Add a prefix if TYPO3 is behind a proxy: ext-domain.com => int-server.com/prefix
                 if (self::cmpIP($_SERVER['REMOTE_ADDR'] ?? '', $GLOBALS['TYPO3_CONF_VARS']['SYS']['reverseProxyIP'] ?? '')) {
                     if (self::getIndpEnv('TYPO3_SSL') && $GLOBALS['TYPO3_CONF_VARS']['SYS']['reverseProxyPrefixSSL']) {
@@ -2490,6 +2487,7 @@ class GeneralUtility
                         $retVal = $GLOBALS['TYPO3_CONF_VARS']['SYS']['reverseProxyPrefix'] . $retVal;
                     }
                 }
+                $retVal = self::encodeFileSystemPathComponentForUrlPath($retVal);
                 break;
             case 'SCRIPT_FILENAME':
                 $retVal = Environment::getCurrentScript();
@@ -2518,17 +2516,7 @@ class GeneralUtility
                 }
                 break;
             case 'PATH_INFO':
-                // $_SERVER['PATH_INFO'] != $_SERVER['SCRIPT_NAME'] is necessary because some servers (Windows/CGI)
-                // are seen to set PATH_INFO equal to script_name
-                // Further, there must be at least one '/' in the path - else the PATH_INFO value does not make sense.
-                // IF 'PATH_INFO' never works for our purpose in TYPO3 with CGI-servers,
-                // then 'PHP_SAPI=='cgi'' might be a better check.
-                // Right now strcmp($_SERVER['PATH_INFO'], GeneralUtility::getIndpEnv('SCRIPT_NAME')) will always
-                // return FALSE for CGI-versions, but that is only as long as SCRIPT_NAME is set equal to PATH_INFO
-                // because of PHP_SAPI=='cgi' (see above)
-                if (!Environment::isRunningOnCgiServer()) {
-                    $retVal = $_SERVER['PATH_INFO'] ?? '';
-                }
+                $retVal = $_SERVER['PATH_INFO'] ?? '';
                 break;
             case 'TYPO3_REV_PROXY':
                 $retVal = self::cmpIP($_SERVER['REMOTE_ADDR'] ?? '', $GLOBALS['TYPO3_CONF_VARS']['SYS']['reverseProxyIP']);
@@ -2601,7 +2589,10 @@ class GeneralUtility
                 // Some CGI-versions (LA13CGI) and mod-rewrite rules on MODULE versions will deliver a 'wrong' DOCUMENT_ROOT (according to our description). Further various aliases/mod_rewrite rules can disturb this as well.
                 // Therefore the DOCUMENT_ROOT is now always calculated as the SCRIPT_FILENAME minus the end part shared with SCRIPT_NAME.
                 $SFN = self::getIndpEnv('SCRIPT_FILENAME');
-                $SN_A = explode('/', strrev(self::getIndpEnv('SCRIPT_NAME')));
+                // Use rawurldecode to reverse the result of self::encodeFileSystemPathComponentForUrlPath()
+                // which has been applied to getIndpEnv(SCRIPT_NAME) for web URI usage.
+                // We compare with a file system path (SCRIPT_FILENAME) in here and therefore need to undo the encoding.
+                $SN_A = array_map('rawurldecode', explode('/', strrev(self::getIndpEnv('SCRIPT_NAME'))));
                 $SFN_A = explode('/', strrev($SFN));
                 $acc = [];
                 foreach ($SN_A as $kk => $vv) {
@@ -2741,6 +2732,11 @@ class GeneralUtility
         return !empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off';
     }
 
+    protected static function encodeFileSystemPathComponentForUrlPath(string $path): string
+    {
+        return implode('/', array_map('rawurlencode', explode('/', $path)));
+    }
+
     /*************************
      *
      * TYPO3 SPECIFIC FUNCTIONS
diff --git a/typo3/sysext/core/Tests/Acceptance/Support/Extension/BackendCoreEnvironment.php b/typo3/sysext/core/Tests/Acceptance/Support/Extension/BackendCoreEnvironment.php
index cd6fd136e47120d4c04b014471951ea95506ef79..e040634ce7568fe94a489bfefe1f15d3fbe421b9 100644
--- a/typo3/sysext/core/Tests/Acceptance/Support/Extension/BackendCoreEnvironment.php
+++ b/typo3/sysext/core/Tests/Acceptance/Support/Extension/BackendCoreEnvironment.php
@@ -155,7 +155,6 @@ class BackendCoreEnvironment extends BackendEnvironment
             'SCRIPT_NAME' => '/typo3/index.php',
             'PHP_SELF' => '/typo3/index.php',
             'SCRIPT_FILENAME' => $docRoot . '/index.php',
-            'PATH_TRANSLATED' => $docRoot . '/index.php',
             'QUERY_STRING' => $requestUrlParts['query'] ?? '',
             'REQUEST_URI' => $requestUrlParts['path'] . (isset($requestUrlParts['query']) ? '?' . $requestUrlParts['query'] : ''),
             'REQUEST_METHOD' => $method,
diff --git a/typo3/sysext/core/Tests/Unit/Http/NormalizedParamsTest.php b/typo3/sysext/core/Tests/Unit/Http/NormalizedParamsTest.php
index db017e069081ab3b3bd8f1e9ac9124fbd4b662c9..95a7b6f883b6a90ce87546c58bfcdc9fa072dc6f 100644
--- a/typo3/sysext/core/Tests/Unit/Http/NormalizedParamsTest.php
+++ b/typo3/sysext/core/Tests/Unit/Http/NormalizedParamsTest.php
@@ -369,77 +369,19 @@ class NormalizedParamsTest extends UnitTestCase
                 [],
                 '',
             ],
-            'use ORIG_SCRIPT_NAME if ORIG_PATH_INFO is set but empty' => [
-                [
-                    'ORIG_PATH_INFO' => '',
-                    'PATH_INFO' => '',
-                    'ORIG_SCRIPT_NAME' => '/orig/script/name.php',
-                    'SCRIPT_NAME' => '/script/name.php',
-                ],
-                [],
-                '/orig/script/name.php',
-            ],
-            'use ORIG_SCRIPT_NAME if PATH_INFO is set but empty' => [
-                [
-                    'PATH_INFO' => '',
-                    'ORIG_SCRIPT_NAME' => '/orig/script/name.php',
-                    'SCRIPT_NAME' => '/script/name.php',
-                ],
-                [],
-                '/orig/script/name.php',
-            ],
-            'use SCRIPT_NAME if ORIG_PATH_INFO is set but empty' => [
-                [
-                    'ORIG_PATH_INFO' => '',
-                    'PATH_INFO' => '',
-                    'ORIG_SCRIPT_NAME' => '',
-                    'SCRIPT_NAME' => '/script/name.php',
-                ],
-                [],
-                '/script/name.php',
-            ],
-            'use SCRIPT_NAME if PATH_INFO is set but empty' => [
-                [
-                    'PATH_INFO' => '',
-                    'ORIG_SCRIPT_NAME' => '',
-                    'SCRIPT_NAME' => '/script/name.php',
-                ],
-                [],
-                '/script/name.php',
-            ],
-            'use SCRIPT_NAME if ORIG_PATH_INFO is set' => [
-                [
-                    'ORIG_PATH_INFO' => '/foo/bar',
-                    'PATH_INFO' => '',
-                    'ORIG_SCRIPT_NAME' => '',
-                    'SCRIPT_NAME' => '/script/name.php',
-                ],
-                [],
-                '/script/name.php',
-            ],
-            'use SCRIPT_NAME if PATH_INFO is set' => [
+            'use SCRIPT_NAME' => [
                 [
-                    'PATH_INFO' => '/foo/bar',
-                    'ORIG_SCRIPT_NAME' => '',
                     'SCRIPT_NAME' => '/script/name.php',
                 ],
                 [],
                 '/script/name.php',
             ],
-            'use ORIG_SCRIPT_NAME' => [
-                [
-                    'ORIG_SCRIPT_NAME' => '/orig/script/name.php',
-                    'SCRIPT_NAME' => '/script/name.php',
-                ],
-                [],
-                '/orig/script/name.php',
-            ],
-            'use SCRIPT_NAME' => [
+            'apply URL encoding to SCRIPT_NAME' => [
                 [
-                    'SCRIPT_NAME' => '/script/name.php',
+                    'SCRIPT_NAME' => '/test:site/script/name.php',
                 ],
                 [],
-                '/script/name.php',
+                '/test%3Asite/script/name.php',
             ],
             'add proxy ssl prefix' => [
                 [
@@ -509,6 +451,14 @@ class NormalizedParamsTest extends UnitTestCase
                 [],
                 '/typo3/index.php?parameter=foo/bar&id=42',
             ],
+            'use query string and script name in special subdirectory if REQUEST_URI is not set' => [
+                [
+                    'QUERY_STRING' => 'parameter=foo/bar&id=42',
+                    'SCRIPT_NAME' => '/sub:dir/typo3/index.php',
+                ],
+                [],
+                '/sub%3Adir/typo3/index.php?parameter=foo/bar&id=42',
+            ],
             'prefix with proxy prefix with ssl if using REQUEST_URI' => [
                 [
                     'HTTP_HOST' => 'www.domain.com',
@@ -936,7 +886,6 @@ class NormalizedParamsTest extends UnitTestCase
         $serverParams = [
             'SCRIPT_NAME' => '/typo3/index.php',
             'HTTP_HOST' => 'www.domain.com',
-            'PATH_INFO' => '/typo3/index.php',
         ];
         $pathThisScript = '/var/www/myInstance/Web/typo3/index.php';
         $pathSite = '/var/www/myInstance/Web';
@@ -1013,7 +962,8 @@ class NormalizedParamsTest extends UnitTestCase
         return [
             'not in a sub directory' => [
                 [
-                    'SCRIPT_NAME' => '/typo3/index.php?id=42&foo=bar',
+                    'SCRIPT_NAME' => '/typo3/index.php',
+                    'REQUEST_URI' => '/typo3/index.php?id=42&foo=bar',
                     'HTTP_HOST' => 'www.domain.com',
                 ],
                 '/var/www/myInstance/Web/typo3/index.php',
@@ -1022,7 +972,8 @@ class NormalizedParamsTest extends UnitTestCase
             ],
             'in a sub directory' => [
                 [
-                    'SCRIPT_NAME' => '/some/sub/dir/typo3/index.php?id=42&foo=bar',
+                    'SCRIPT_NAME' => '/some/sub/dir/typo3/index.php',
+                    'REQUEST_URI' => '/some/sub/dir/typo3/index.php?id=42&foo=bar',
                     'HTTP_HOST' => 'www.domain.com',
                 ],
                 '/var/www/myInstance/Web/typo3/index.php',
@@ -1062,9 +1013,9 @@ class NormalizedParamsTest extends UnitTestCase
     public function getPathInfoReturnsExpectedValue(): void
     {
         $serverParams = [
-            'PATH_INFO' => '/typo3/index.php',
+            'PATH_INFO' => '/foo/bar',
         ];
-        $expected = '/typo3/index.php';
+        $expected = '/foo/bar';
         $serverRequestParameters = new NormalizedParams($serverParams, [], '', '');
         self::assertSame($expected, $serverRequestParameters->getPathInfo());
     }
diff --git a/typo3/sysext/core/Tests/Unit/Log/Processor/WebProcessorTest.php b/typo3/sysext/core/Tests/Unit/Log/Processor/WebProcessorTest.php
index 45d8c6b8a261e8c0c375ed438af858959c429073..a2499385d043b6fe9fbb24a08f39db6260b198af 100644
--- a/typo3/sysext/core/Tests/Unit/Log/Processor/WebProcessorTest.php
+++ b/typo3/sysext/core/Tests/Unit/Log/Processor/WebProcessorTest.php
@@ -33,9 +33,8 @@ class WebProcessorTest extends UnitTestCase
      */
     public function webProcessorAddsWebDataToLogRecord(): void
     {
-        $_SERVER['PATH_INFO'] = '';
         $_SERVER['REQUEST_URI'] = '';
-        $_SERVER['ORIG_SCRIPT_NAME'] = '';
+        $_SERVER['SCRIPT_NAME'] = '';
         $_SERVER['REMOTE_ADDR'] = '';
         $_SERVER['QUERY_STRING'] = '';
         $_SERVER['SSL_SESSION_ID'] = '';
diff --git a/typo3/sysext/core/Tests/Unit/Resource/ResourceCompressorTest.php b/typo3/sysext/core/Tests/Unit/Resource/ResourceCompressorTest.php
index 3b2300f7cd80ec9a918c36e252119052a0c12947..f1ac430e8d1e03a2c68eeadc1c409b8ad2702f02 100644
--- a/typo3/sysext/core/Tests/Unit/Resource/ResourceCompressorTest.php
+++ b/typo3/sysext/core/Tests/Unit/Resource/ResourceCompressorTest.php
@@ -637,7 +637,7 @@ class ResourceCompressorTest extends BaseTestCase
         // script point here to fake the backend call.
         $bePath = Environment::getBackendPath();
         $subfolderFake = basename(Environment::getPublicPath());
-        $_SERVER['ORIG_SCRIPT_NAME'] = '/' . $subfolderFake . '/typo3/index.php';
+        $_SERVER['SCRIPT_NAME'] = '/' . $subfolderFake . '/typo3/index.php';
         Environment::initialize(
             Environment::getContext(),
             true,
diff --git a/typo3/sysext/extbase/Tests/Unit/Mvc/Web/Routing/UriBuilderTest.php b/typo3/sysext/extbase/Tests/Unit/Mvc/Web/Routing/UriBuilderTest.php
index fe527fb26a8ece5881dd41e99e31f32ab7bcc924..29686f557cf24edc16ac29d649f4c312cfe6e8af 100644
--- a/typo3/sysext/extbase/Tests/Unit/Mvc/Web/Routing/UriBuilderTest.php
+++ b/typo3/sysext/extbase/Tests/Unit/Mvc/Web/Routing/UriBuilderTest.php
@@ -379,7 +379,6 @@ class UriBuilderTest extends UnitTestCase
         $GLOBALS['TYPO3_REQUEST'] = $this->getRequestWithRouteAttribute();
         $_SERVER['HTTP_HOST'] = 'baseuri';
         $_SERVER['SCRIPT_NAME'] = '/index.php';
-        $_SERVER['ORIG_SCRIPT_NAME'] = '/index.php';
         $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
         $this->uriBuilder->setCreateAbsoluteUri(true);
         $expectedResult = 'http://baseuri/' . TYPO3_mainDir . 'test/Path?token=dummyToken';
@@ -406,7 +405,6 @@ class UriBuilderTest extends UnitTestCase
         $GLOBALS['TYPO3_REQUEST'] = $this->getRequestWithRouteAttribute();
         $_SERVER['HTTP_HOST'] = 'baseuri';
         $_SERVER['SCRIPT_NAME'] = '/typo3/index.php';
-        $_SERVER['ORIG_SCRIPT_NAME'] = '/typo3/index.php';
         $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
         $this->uriBuilder->setCreateAbsoluteUri(true);
         $expectedResult = 'http://baseuri/' . TYPO3_mainDir . 'test/Path?token=dummyToken';
diff --git a/typo3/sysext/felogin/Tests/Unit/Validation/RedirectUrlValidatorTest.php b/typo3/sysext/felogin/Tests/Unit/Validation/RedirectUrlValidatorTest.php
index 381737e85d6f8879a3c83e11978b1c429d4e4532..d3f37fce7fd2e765804790ad9dc181513ba4a976 100644
--- a/typo3/sysext/felogin/Tests/Unit/Validation/RedirectUrlValidatorTest.php
+++ b/typo3/sysext/felogin/Tests/Unit/Validation/RedirectUrlValidatorTest.php
@@ -78,7 +78,7 @@ class RedirectUrlValidatorTest extends UnitTestCase
      */
     protected function setUpFakeSitePathAndHost(): void
     {
-        $_SERVER['ORIG_PATH_INFO'] = $_SERVER['PATH_INFO'] = $_SERVER['ORIG_SCRIPT_NAME'] = $_SERVER['SCRIPT_NAME'] = $this->testSitePath . TYPO3_mainDir;
+        $_SERVER['SCRIPT_NAME'] = $this->testSitePath . TYPO3_mainDir;
         $_SERVER['HTTP_HOST'] = $this->testHostName;
 
         $request = ServerRequestFactory::fromGlobals();
diff --git a/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php b/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php
index 3e46d116c810cbeae1a572aefa81adf00d3d6ec9..cc417874088a176a94ea10cbf6963935e53befed 100644
--- a/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php
+++ b/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php
@@ -3026,6 +3026,7 @@ class TypoScriptFrontendController implements LoggerAwareInterface
         if (!$this->absRefPrefix) {
             return;
         }
+        $encodedAbsRefPrefix = htmlspecialchars($this->absRefPrefix, ENT_QUOTES | ENT_HTML5);
         $search = [
             '"_assets/',
             '"typo3temp/',
@@ -3034,17 +3035,17 @@ class TypoScriptFrontendController implements LoggerAwareInterface
             '"' . PathUtility::stripPathSitePrefix(Environment::getFrameworkBasePath()) . '/',
         ];
         $replace = [
-            '"' . $this->absRefPrefix . '_assets/',
-            '"' . $this->absRefPrefix . 'typo3temp/',
-            '"' . $this->absRefPrefix . PathUtility::stripPathSitePrefix(Environment::getExtensionsPath()) . '/',
-            '"' . $this->absRefPrefix . PathUtility::stripPathSitePrefix(Environment::getBackendPath()) . '/ext/',
-            '"' . $this->absRefPrefix . PathUtility::stripPathSitePrefix(Environment::getFrameworkBasePath()) . '/',
+            '"' . $encodedAbsRefPrefix . '_assets/',
+            '"' . $encodedAbsRefPrefix . 'typo3temp/',
+            '"' . $encodedAbsRefPrefix . PathUtility::stripPathSitePrefix(Environment::getExtensionsPath()) . '/',
+            '"' . $encodedAbsRefPrefix . PathUtility::stripPathSitePrefix(Environment::getBackendPath()) . '/ext/',
+            '"' . $encodedAbsRefPrefix . PathUtility::stripPathSitePrefix(Environment::getFrameworkBasePath()) . '/',
         ];
         // Process additional directories
         $directories = GeneralUtility::trimExplode(',', $GLOBALS['TYPO3_CONF_VARS']['FE']['additionalAbsRefPrefixDirectories'], true);
         foreach ($directories as $directory) {
             $search[] = '"' . $directory;
-            $replace[] = '"' . $this->absRefPrefix . $directory;
+            $replace[] = '"' . $encodedAbsRefPrefix . $directory;
         }
         $this->content = str_replace(
             $search,