CVE-2021-48011

{
  "etk_id": "ETK-2026-1420",
  "cve_id": "CVE-2021-48011",
  "display_id": "CVE-2021-48011",
  "ghsa_id": null,
  "euvd_id": "EUVD-2021-34884",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in servor",
  "summary": "Servor versions 1.0.0 through 4.0.2 are affected by a path traversal vulnerability. An unauthenticated remote attacker can access files and enumerate directories outside the configured served root through crafted request paths.",
  "mitigation": "Upgrade to a release newer than 4.0.2 if one is available and verify that encoded traversal sequences are rejected before path resolution. Until then, restrict access to the service and run it with minimal filesystem permissions.",
  "vendor": "lukejacksonn",
  "product": "servor",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.0.0, <= 4.0.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "servor",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0056,
  "epss_percentile": 0.4554,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 63.496081833333335,
  "t0_at": "2026-10-12T20:55:05.305000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T20:55:05.305000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T20:55:05.305000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-48011"
    }
  }
}