Path Traversal Vulnerability in YARD Documentation Tool by Ruby

CVE-2026-49342

What is CVE-2026-49342?

The YARD documentation generation tool for Ruby has a vulnerable static cache lookup mechanism that makes it susceptible to path traversal attacks. Before version 0.9.44, an attacker could exploit this vulnerability by crafting a request that navigates outside of the intended document root. This could potentially allow unauthorized access to sensitive files, such as a readable sibling .html file located outside the specified static resource tree. The issue has been addressed in version 0.9.44, which implements necessary security measures to prevent such unauthorized access.

References