CVE-2026-49342
published 2026-06-19CVE-2026-49342: YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.27%
19.2th percentile
YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as `/../yard-cache-secret.html` is joined against that root and can return a readable sibling `.html` file outside the intended static tree. Version 0.9.44 patches the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lsegal | yard | < 0.9.44 | 0.9.44 |
| yardoc | yard | >= 0 < 0.9.44 | 0.9.44 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
YARD static cache reads raw traversal paths before router sanitization
ghsa·2026-06-26
CVE-2026-49342 [MEDIUM] CWE-22 YARD static cache reads raw traversal paths before router sanitization
YARD static cache reads raw traversal paths before router sanitization
### Summary
YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as `/../yard-cache-secret.html` is joined against that root and can return a readable sibling `.html` file outside the intended static tree.
The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.
### Details
The `--docroot` CLI option stores the configured directory in `server_options[:DocumentRoot]` at `lib/yard/cli/server.rb:198`, and adapter in
VulDB
lsegal yard up to 0.9.43 yard-cache-secret.html path traversal (GHSA-pxcc-8665-phx8)
vuldb·2026-06-19
CVE-2026-49342 [CRITICAL] lsegal yard up to 0.9.43 yard-cache-secret.html path traversal (GHSA-pxcc-8665-phx8)
A vulnerability classified as critical has been found in lsegal yard up to 0.9.43. Affected by this issue is some unknown functionality of the file yard-cache-secret.html. Performing a manipulation results in path traversal.
This vulnerability was named CVE-2026-49342. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
Red Hat
yard: YARD: Information disclosure via path traversal in static cache lookup
vendor_redhat·2026-06-19·CVSS 5.3
CVE-2026-49342 [MEDIUM] CWE-22 yard: YARD: Information disclosure via path traversal in static cache lookup
yard: YARD: Information disclosure via path traversal in static cache lookup
YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as `/../yard-cache-secret.html` is joined against that root and can return a readable sibling `.html` file outside the intended static tree. Version 0.9.44 patches the issue.
A flaw was found in YARD, a documentation generation tool for the Ruby programming language. A remote attacker could exploit a path traversal vulnerability in YARD's static cache lookup. This occurs because the request path is read before the router's path cleanup, allowing a specially
No detection rules found.
No public exploits indexed.
2026-06-19
Published