YARD EUVD-2026-28554

The vulnerability requires SPECIFIC conditions: yard server must be actively running with the --docroot parameter set to define a custom document root directory. The vulnerability does NOT occur when using the default WEBrick server backend (which sanitizes paths automatically). Exploitation requires network access to the yard server port (typically localhost:8808 unless explicitly exposed). The attacker does not require authentication; the vulnerability is exploitable by any network-accessible client sending crafted HTTP requests. Non-default configurations or running yard server in untrusted environments without additional web server protections are the primary risk factors. Default installations using only 'yard server' without --docroot are not vulnerable.

CVSS v4.0 score of 6.9 with AV:N (network-accessible) and AC:L (low complexity) indicates a reasonably accessible attack vector. However, the impact is limited to confidentiality (VC:L - low confidentiality impact), with no integrity or availability impact, suggesting information disclosure rather than code execution. The vulnerability requires yard server to be actively running with the --docroot parameter configured in an untrusted network environment, which is not a default deployment scenario. EPSS score and KEV status were not provided, so real-world exploitation likelihood cannot be definitively assessed. The patch availability (version 0.9.42 released) and vendor recommendation to upgrade immediately suggest the vendor considers this a legitimate risk in certain deployments. This is a targeted vulnerability affecting developers or organizations using YARD for internal documentation hosting; widespread exploitation is unlikely unless yard server instances are exposed to untrusted networks without additional web server protections.

An attacker discovers a YARD documentation server running on an internal or exposed network using yard server with --docroot configured. The attacker crafts HTTP requests containing path traversal sequences (e.g., GET /../../etc/passwd or GET /%2e%2e/sensitive_file.txt) targeting the server. If the server is not using WEBrick and the path sanitization patch is not applied, the server processes the unsanitized request and returns arbitrary files from the host system, allowing the attacker to read sensitive configuration files, source code, or other documentation.