CVE-2017-17042
Arbitrary file read vulnerability in yard server
CVE-2017-17042 is a high vulnerability (CVSS 7.5) in Yardoc Yard, published November 28, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.89%, the 86th percentile. Fixed in yard 0.9.11.
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
- Record
CVE-2017-17042- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
- Record
CVE-2017-17042- Updated
- 2026-11-02
EUVDEUVD-2017-0362 No score
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
- Record
EUVD-2017-0362- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gj4p-3wh3-2rmf
Arbitrary file read vulnerability in yard server
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
- Record
GHSA-gj4p-3wh3-2rmf- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
- Record
CVE-2017-17042- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-17042
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
- Record
DEBIAN-CVE-2017-17042- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-gj4p-3wh3-2rmf
Arbitrary file read vulnerability in yard server
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
- Record
GHSA-gj4p-3wh3-2rmf- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-17042
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
- Record
UBUNTU-CVE-2017-17042- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11532-1 No score
yast2-buildtools-4.4.1-1.2 on GA media
These are all security issues fixed in the yast2-buildtools-4.4.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11532-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:1890-1 No score
Security update for rubygem-yard
This update for rubygem-yard fixes the following issues:
- CVE-2017-17042: The server in YARD did not block relative paths with an initial ../ sequence, which allowed attackers to conduct directory traversal attacks and read arbitrary files (bsc#1070263).
- Record
SUSE-SU-2018:1890-1- Updated
- 2026-11-02
OSVUSN-6731-1 No score
yard vulnerabilities
It was discovered that YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-17042)
It was discovered that yard before 0.9.20 is affected by a path traversal vulnerability, allowing HTTP requests to access arbitrary files under certain conditions. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-1020001)
Aviv Keller discovered that the "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. (CVE-2024-27285)
- Record
USN-6731-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yardRubyGems |
before 0.9.11 | 0.9.11 |
yardDebian:12 |
before 0.9.12-1 | 0.9.12-1 |
yardDebian:13 |
before 0.9.12-1 | 0.9.12-1 |
yardDebian:14 |
before 0.9.12-1 | 0.9.12-1 |
yardRubyGems |
before 0.9.11, plus listed versions 0.2.00.2.10.2.20.2.30.2.3.2 Show 45 moreShow less0.2.3.30.2.3.40.2.3.50.4.00.5.00.5.10.5.1p10.5.20.5.30.5.40.5.50.5.60.5.70.5.80.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.7.20.7.30.7.40.7.50.8.00.8.10.8.20.8.2.10.8.30.8.40.8.4.10.8.50.8.5.10.8.5.20.8.60.8.6.10.8.6.20.8.70.8.7.10.8.7.2 |
0.9.11 |
rubygem-yardSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.8.7.3-7.3.1 | 0.8.7.3-7.3.1 |
yardUbuntu:Pro:16.04:LTS |
before 0.8.7.6+git20160220-3ubuntu0.1~esm1, plus listed versions 0.8.7.6-10.8.7.6+git20160220-3 |
0.8.7.6+git20160220-3ubuntu0.1~esm1 |
yardUbuntu:Pro:18.04:LTS |
before 0.9.12-2ubuntu0.1~esm1, plus listed versions 0.9.9-10.9.12-10.9.12-1ubuntu30.9.12-2 |
0.9.12-2ubuntu0.1~esm1 |
yardUbuntu:20.04:LTS |
before 0.9.24-1+deb11u1build0.20.04.1, plus listed versions 0.9.16-10.9.20-10.9.24-1 |
0.9.24-1+deb11u1build0.20.04.1 |
yardUbuntu:22.04:LTS |
before 0.9.26-1ubuntu0.1, plus listed versions 0.9.24-10.9.26-1 |
0.9.26-1ubuntu0.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4
nvd.nist.gov/vuln/detail/CVE-2017-17042
security-tracker.debian.org/tracker/CVE-2017-17042
Show 8 moreShow less
Left out here: 15 versions. The JSON record has them.