YARD EUVD-2026-38069

YARD must be running as a web server (not used solely as a CLI documentation generator). The adapter.document_root setting must be configured on the server - this activates the static caching subsystem that contains the vulnerable path construction. The attacker requires HTTP network access to the YARD server port. Exploitation is limited exclusively to reading .html files, as the vulnerable code forces a .html extension on all resolved cache paths; binary files, configuration files, credentials, and non-HTML assets are not directly readable through this vector. Practical impact is further bounded by the file system layout: only .html files present in directories that are siblings of (or otherwise reachable via traversal from) the document root are accessible. No authentication is required per CVSS PR:N - exploitation succeeds against any unauthenticated HTTP client that can reach the server.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), correctly reflecting unauthenticated network access with low attack complexity and a confidentiality-only impact. Real-world risk is further bounded by two factors not captured in the raw CVSS score: first, YARD must be deployed in server mode with adapter.document_root configured - YARD is primarily a CLI documentation generator and its server component is not universally exposed; second, the traversal is constrained to reading only .html files (the code forces a .html extension on all cache paths), so non-HTML sensitive data is not directly accessible. No EPSS data was provided in the source intelligence, and the vulnerability is not in CISA KEV. SSVC signals: exploitation status is none/public, the attack is likely automatable given AC:L and PR:N, but technical impact is partial (read-only, limited file type). This vulnerability represents a genuine but narrowly scoped confidentiality risk - highest for environments exposing the YARD server on shared infrastructure with sensitive HTML files adjacent to the document root, and low for typical developer-workstation YARD CLI usage.

An attacker with HTTP access to a running YARD server sends GET /../sensitive-docs.html HTTP/1.1, which the static cache lookup processes before any router-level path cleanup. The code constructs File.join(document_root, '/../sensitive-docs.html'), which the OS resolves to a sibling directory of the document root, and YARD reads and returns the contents of that file in the HTTP response. No credentials or prior access are required. No public POC has been identified at time of analysis, but the traversal mechanism is straightforward enough to replicate from the advisory and commit diff alone.