What’s Vulnerable › Vulnerabilities

CVE-2021-48011: Servor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segments

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-16
• Weakness: CWE-22

Description

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.

Affected products

• lukejacksonn servor: from 1.0.0 through 4.0.2

References

• https://github.com/lukejacksonn/servor
• https://github.com/lukejacksonn/servor/commit/ec7d824ea6903c0fb97a452045bbb8335198cbab
• https://github.com/lukejacksonn/servor/pull/70
• https://www.vulncheck.com/advisories/servor-1.0.0-through-4.0.2-unauthenticated-path-traversal-via-url-encoded-dot-segments

Get alerted when CVE-2021-48011 or the next vulnerability affects your stack