Servor: Path traversal via URL-encoded dot segments
Summary
Servor, a Node.js development file server, contains a path traversal vulnerability in its static file and directory listing code. An unauthenticated remote attacker can send URL-encoded dot segments (%2e%2e/) to escape the served root directory. This allows reading arbitrary files and listing directories outside the root, which may expose configuration files or secrets if they are stored near the web root.
Affected
- Servor 1.0.0 through 4.0.2
- Default configuration is unaffected according to the CVE record; the affected code paths are the static file and directory listing handlers.
Fixed in
- Fixed by commit ec7d824ea6903c0fb97a452045bbb8335198cbab ("Prevent path traversal (#70)").
- Fixed release version: Unknown. Check the GitHub releases page and the npm registry for a version newer than 4.0.2 that includes the commit.
Workaround
- Unknown. No vendor-stated workaround was found.
- Stop using the affected version or do not expose it to untrusted networks.
- If it must stay reachable, place a reverse proxy in front that rejects encoded dot segments.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed as known exploited in the sources reviewed.
- No public proof of concept found in the sources reviewed; this does not rule one out.
- EPSS is very low (0.0056) according to Vulners.
Our recommendation
- Inventory Node.js projects and hosts that use Servor, including lockfiles and npm dependency lists.
- Remove Servor or isolate it where it is reachable from the internet or untrusted networks, such as staging sites or shared demo hosts.
- Upgrade to a release that includes commit ec7d824 once the fixed version is confirmed.
- Check served directories for sensitive files such as .env files and keys, and monitor logs for requests containing %2e%2e.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2021-48011 VulnCheck advisory www.vulncheck.com
- Fix commit ec7d824 github.com
- Pull request #70 github.com
- Servor GitHub repository github.com
- OSV CVE-2021-48011 osv.dev
- Vulners PT-2026-110917 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:45.
Original description (NVD)
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.