EUVD-2026-38069
GHSA-pxcc-8665-phx8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Server is network-accessible with no auth required; traversal is mechanically simple (AC:L); only .html files readable limits confidentiality to Low; no integrity or availability impact exists.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree. Version 0.9.44 patches the issue.
AnalysisAI
Path traversal in the YARD Ruby documentation server (prior to 0.9.44) allows unauthenticated remote attackers to read arbitrary .html files from directories outside the configured document root by supplying crafted ../-containing request paths such as /../yard-cache-secret.html. The flaw exists because the static cache lookup in StaticCaching#check_static_cache constructs a filesystem path from the raw request.path before the router's own path-sanitization logic runs, enabling traversal to sibling directories. No active exploitation has been identified (not in CISA KEV) and no public POC exists at time of analysis; the vendor-released fix is version 0.9.44.
Technical ContextAI
YARD is a widely used Ruby documentation generation tool with an optional built-in web server component. The vulnerability resides in lib/yard/server/static_caching.rb and lib/yard/server/commands/base.rb. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the static cache lookup called check_static_cache constructs a filesystem path by invoking File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') without any prior validation of .. components. Because the router's cleanup phase executes after cache lookup, a traversal sequence in the request path is never stripped before the File.join resolves it on disk. The fix (commit f78c19f0dd33a407085b4ed181bb60c0aa0078b4) introduces a new cache_path private method in StaticCaching that explicitly rejects paths containing .. segments (request_path.split(/[\/\\]/).include?('..')), strips leading slashes, blocks Windows drive-letter patterns, and applies File.cleanpath normalization before joining against the document root. CPE: cpe:2.3:a:lsegal:yard:*:*:*:*:*:*:*:* covering all versions prior to 0.9.44.
RemediationAI
Upgrade YARD to version 0.9.44 or later; this is the vendor-released patch that resolves the path traversal by introducing sanitized path construction in StaticCaching#cache_path. The advisory and patch commit are available at https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8 and https://github.com/lsegal/yard/commit/f78c19f0dd33a407085b4ed181bb60c0aa0078b4 respectively. If an immediate upgrade is not feasible, bind the YARD server to localhost only (e.g., yard server --host 127.0.0.1) to eliminate remote network exposure - this compensating control is highly effective since the CVSS attack vector is Network (AV:N) and restricting the listening interface fully blocks unauthenticated remote exploitation, with no functional side-effects for local development use. Alternatively, place the YARD server behind an authenticating reverse proxy to enforce access control at the network boundary.
YARD is a Ruby Documentation tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no auth
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence
yard before 0.9.20 allows path traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Path traversal vulnerability in YARD prior to version 0.9.42 allows remote attackers to access arbitrary files on a serv
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today