{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/servor/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:servor_project:servor:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2021-48011"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Servor (1.0.0 through 4.0.2)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","path-traversal","information-disclosure"],"_cs_type":"advisory","_cs_vendors":["Servor"],"content_html":"\u003cp\u003eServor versions 1.0.0 through 4.0.2 contain a path traversal vulnerability that exposes the host file system to unauthenticated remote attackers. The vulnerability resides within the serveStaticFile and serveDirectoryListing functions, where the application incorrectly handles URL-encoded dot segments. Specifically, the application uses decodeURI() on the input path before processing it with path.join(), effectively negating intended directory protections. An attacker can supply a specially crafted request containing %2e%2e/ sequences to escape the designated root directory. This allows for the exfiltration of sensitive configuration files, source code, or internal system data, as well as the ability to traverse and enumerate the directory structure of the underlying server.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to bypass access controls to read arbitrary files and enumerate directory contents on the server. This can lead to significant information disclosure, exposing sensitive environment variables, system credentials, or proprietary application logic, which may facilitate further compromise of the host system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Servor package to version 4.0.3 or later to receive the patch that properly sanitizes input paths against traversal sequences.\u003c/li\u003e\n\u003cli\u003eConfigure the web server environment to restrict access to sensitive root directories and apply least-privilege principles to the user account running the Servor application process.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering and inspection on the perimeter firewall or web application firewall to identify and block requests containing URL-encoded path traversal sequences such as %2e%2e/.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:39:57Z","date_published":"2026-10-12T22:39:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2021-48011/","summary":"Servor versions 1.0.0 through 4.0.2 are vulnerable to path traversal via URL-encoded dot segments, allowing unauthenticated attackers to read arbitrary files and list directories.","title":"Path Traversal Vulnerability in Servor","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2021-48011/"}],"language":"en","title":"CraftedSignal Threat Feed - Servor","version":"https://jsonfeed.org/version/1.1"}