high7.5
CVE-2026-41493
yard: Possible arbitrary path traversal and file access via yard server
Impact
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | yard | < 0.9.42 | 0.9.42 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yardoc | Yard | before 0.9.42 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-3jfp-46x4-xgfj
- https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj
- https://nvd.nist.gov/vuln/detail/CVE-2026-41493
- https://github.com/lsegal/yard/releases/tag/v0.9.42
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2026-41493.yml