Servor (1.0.0 Through 4.0.2)

Servor versions 1.0.0 through 4.0.2 are vulnerable to path traversal via URL-encoded dot segments, allowing unauthenticated attackers to read arbitrary files and list directories.