Every CVE Search/ Get API key

CVE-2026-41493

yard: Possible arbitrary path traversal and file access via yard server

6.9 MediumFix available

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.39%Up 0.3 points since May 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

yard: Possible arbitrary path traversal and file access via yard server

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.

Record
CVE-2026-41493
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-28554 6.9

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.

Record
EUVD-2026-28554
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3jfp-46x4-xgfj 6.9

yard: Possible arbitrary path traversal and file access via yard server

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Record
GHSA-3jfp-46x4-xgfj
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
NVD 6.9

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.

Record
CVE-2026-41493
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 6.9

yard: Possible arbitrary path traversal and file access via yard server

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.

Record
CVE-2026-41493
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVDEBIAN-CVE-2026-41493 7.5

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.

Record
DEBIAN-CVE-2026-41493
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-3jfp-46x4-xgfj 6.9

yard: Possible arbitrary path traversal and file access via yard server

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Record
GHSA-3jfp-46x4-xgfj
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVOESA-2026-2205 7.5

rubygem-yard security update

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions.

Security Fix(es):

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.(CVE-2026-41493)

Record
OESA-2026-2205
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-2206 7.5

rubygem-yard security update

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions.

Security Fix(es):

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.(CVE-2026-41493)

Record
OESA-2026-2206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-2207 7.5

rubygem-yard security update

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions.

Security Fix(es):

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.(CVE-2026-41493)

Record
OESA-2026-2207
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-2208 7.5

rubygem-yard security update

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions.

Security Fix(es):

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.(CVE-2026-41493)

Record
OESA-2026-2208
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-2285 7.5

rubygem-yard security update

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions.

Security Fix(es):

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.(CVE-2026-41493)

Record
OESA-2026-2285
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-41493 6.9

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.

Record
UBUNTU-CVE-2026-41493
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUSN-8394-1 No score

yard vulnerability

It was discovered that YARD incorrectly sanitized paths in its built-in documentation server. An attacker could possibly use this issue to read arbitrary files from the server host.

Record
USN-8394-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
yard
RubyGems
 before 0.9.42
0.9.42
yard
Debian:12
 All versions, plus listed versions
0.9.28-20.9.28-2+deb12u10.9.28-2+deb12u20.9.34-10.9.35-1
Show 10 moreShow less
0.9.36-10.9.37-10.9.38-10.9.39-10.9.44-10.9.45-11.17.patch1-52.2-32.2-42.2-5
 None known
yard
Debian:13
 All versions, plus listed versions
0.9.37-10.9.38-10.9.39-10.9.44-10.9.45-1
Show 4 moreShow less
1.17.patch1-52.2-32.2-42.2-5
 None known
yard
Debian:14
 All versions, plus listed versions
0.9.37-10.9.38-10.9.39-10.9.44-10.9.45-1
Show 4 moreShow less
1.17.patch1-52.2-32.2-42.2-5
 None known
yard
RubyGems
 before 0.9.42, plus listed versions
0.2.00.2.10.2.20.2.30.2.3.2
Show 45 moreShow less
0.2.3.30.2.3.40.2.3.50.4.00.5.00.5.10.5.1p10.5.20.5.30.5.40.5.50.5.60.5.70.5.80.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.7.20.7.30.7.40.7.50.8.00.8.10.8.20.8.2.10.8.30.8.40.8.4.10.8.50.8.5.10.8.5.20.8.60.8.6.10.8.6.20.8.70.8.7.10.8.7.2
0.9.42
rubygem-yard
openEuler:20.03-LTS-SP4
 before 0.9.26-4.oe2003sp4
0.9.26-4.oe2003sp4
rubygem-yard
openEuler:24.03-LTS
 before 0.9.34-3.oe2403
0.9.34-3.oe2403
rubygem-yard
openEuler:24.03-LTS-SP1
 before 0.9.34-3.oe2403sp1
0.9.34-3.oe2403sp1
rubygem-yard
openEuler:24.03-LTS-SP3
 before 0.9.34-3.oe2403sp3
0.9.34-3.oe2403sp3
rubygem-yard
openEuler:22.03-LTS-SP4
 before 0.9.26-4.oe2203sp4
0.9.26-4.oe2203sp4
Show 8 moreShow less
Affected packages
PackageAffectedFixed
yard
Ubuntu:Pro:16.04:LTS
 before 0.8.7.6+git20160220-3ubuntu0.1~esm2, plus listed versions
0.8.7.6-10.8.7.6+git20160220-30.8.7.6+git20160220-3ubuntu0.1~esm1
0.8.7.6+git20160220-3ubuntu0.1~esm2
yard
Ubuntu:Pro:18.04:LTS
 before 0.9.12-2ubuntu0.1~esm2, plus listed versions
0.9.9-10.9.12-10.9.12-1ubuntu30.9.12-20.9.12-2ubuntu0.1~esm1
0.9.12-2ubuntu0.1~esm2
yard
Ubuntu:Pro:20.04:LTS
 before 0.9.24-1+deb11u1ubuntu0.1~esm1, plus listed versions
0.9.16-10.9.20-10.9.24-10.9.24-1+deb11u1build0.20.04.1
0.9.24-1+deb11u1ubuntu0.1~esm1
yard
Ubuntu:Pro:22.04:LTS
 before 0.9.26-1ubuntu0.1+esm1, plus listed versions
0.9.24-10.9.26-10.9.26-1ubuntu0.1
0.9.26-1ubuntu0.1+esm1
yard
Ubuntu:Pro:24.04:LTS
 before 0.9.36-1ubuntu0.1~esm1, plus listed versions
0.9.28-20.9.34-10.9.35-10.9.36-1
0.9.36-1ubuntu0.1~esm1
yard
Ubuntu:25.10
 All versions, plus listed versions
0.9.37-1
 None known
yard
Ubuntu:26.10
 All versions, plus listed versions
0.9.38-10.9.39-10.9.45-1
 None known
yard
Ubuntu:Pro:26.04:LTS
 before 0.9.38-1ubuntu0.1~esm1, plus listed versions
0.9.37-10.9.37-1build10.9.38-1
0.9.38-1ubuntu0.1~esm1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41493 is a medium vulnerability (CVSS 6.9) in Lsegal Yard, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in yard 0.9.42.

References

Show 10 moreShow less
This page doesn't list everything

Left out here: 46 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open