The SES interceptor is returning an invalid event when the first part of the pathInfo variable matches the scriptName variable in the getCleanedPaths function in SES.cfc.
This occurs when Coldbox is running in a subfolder off of the webroot.
The issue appears to be involved with line 1442 of /interceptors/SES.cfc in coldbox-5.0.0-rc.1+523-201801091758. The replace
if the first part of the pathInfo variable matches the scriptName this function will remove it when trying to account for nested applications.
The regex would need to match the entire first element of the path up to the slash, similar to this: