Found in WildFly 29.0.0.Beta1 (Core 21.1.0.Beta2). Start the CLI and connect to a server that's running on a Windows box. Then execute command:

echo `/core-service=server-environment:read-attribute(name=config-dir)` 

You'll get back something like this:

D:wildflywildfly-29.0.0.Beta1standaloneconfiguration 

The same problem occurs if you put the value in a variable first:

set configDir=`/core-service=server-environment:read-attribute(name=config-dir)`
echo $configDir

Note that this problem is not the same as WFCORE-5982, though it may be related. 5982 was about backslashes being stripped from input properties. This issue is about backslashes being stripped from the output of a command.