Servor 1.0.0 through 4.0.2 is vulnerable to a path traversal flaw that allows an unauthenticated attacker to escape the configured served root by sending URL-encoded dot segments such as %2e%2e/. The server’s decodeURI() call processes these sequences before joining the path to the filesystem, enabling the attacker to read arbitrary files and list directories outside the intended root. This flaw does not directly execute code but can expose sensitive configuration files, secrets, or other data that may lead to further compromise.

The vulnerable product is Servor, a lightweight static file server maintained by LukeJacksonn. Versions 1.0.0 through 4.0.2 are affected; any deployment of those releases is at risk.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available but the flaw is publicly known and can be exploited remotely over HTTP without authentication. The vulnerability is not listed in the CISA KEV catalog. A remote attacker can construct a malicious URL, cause the server to resolve a path, and retrieve unintended files or directory listings.