PT-2026-110917
CVE-2021-48011
·
Published
2026-10-12
·
Updated
2026-10-13
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Servor versions 1.0.0 through 4.0.2
Description
An issue allows unauthenticated remote attackers to escape the served root directory by sending URL-encoded dot segments. By using
%2e%2e/ sequences, which are processed by decodeURI() before path.join() in the serveStaticFile() and serveDirectoryListing() functions, attackers can read arbitrary files and list directories outside the intended root.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾