CVE-2021-48011
Servor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segments
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.
| CWE | CWE-22 |
| Vendor | lukejacksonn |
| Product | servor |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for lukejacksonn servor
Be the first to know when new high vulnerabilities affecting lukejacksonn servor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
lukejacksonn / servor
1.0.0 ≤ 4.0.2
References
github.com: https://github.com/lukejacksonn/servor/pull/70 github.com: https://github.com/lukejacksonn/servor/commit/ec7d824ea6903c0fb97a452045bbb8335198cbab github.com: https://github.com/lukejacksonn/servor vulncheck.com: https://www.vulncheck.com/advisories/servor-1.0.0-through-4.0.2-unauthenticated-path-traversal-via-url-encoded-dot-segments
Credits
AGIPOO (Kim Jeong-hoon) ooooooo-q