{"id":"CVE-2017-17042","aliases":["DEBIAN-CVE-2017-17042","EUVD-2017-0362","GHSA-gj4p-3wh3-2rmf","SUSE-SU-2018:1890-1","UBUNTU-CVE-2017-17042","USN-6731-1","openSUSE-SU-2024:11532-1"],"status":"published","title":"Arbitrary file read vulnerability in yard server","description":"lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02894,"percentile":0.87017,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2017-11-28T20:00:00Z","modified":"2026-10-20T10:47:47Z","fixes":[{"ecosystem":"RubyGems","package":"yard","fixed_in":["0.9.11"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"yard","fixed_in":["0.9.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"yard","fixed_in":["0.9.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"yard","fixed_in":["0.9.12-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"rubygem-yard","fixed_in":["0.8.7.3-7.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yard","fixed_in":["0.8.7.6+git20160220-3ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.2.3","0.2.3.2","0.2.3.3","0.2.3.4","0.2.3.5","0.4.0","0.5.0","0.5.1","0.5.1p1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.8.0","0.8.1","0.8.2","0.8.2.1","0.8.3","0.8.4","0.8.4.1","0.8.5","0.8.5.1","0.8.5.2","0.8.6","0.8.6.1","0.8.6.2","0.8.7","0.8.7.1","0.8.7.2","0.8.7.3","0.8.7.4","0.8.7.5","0.8.7.6","0.9.0","0.9.1","0.9.10","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"rubygem-yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7.3-7.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7.6+git20160220-3ubuntu0.1~esm1"}]}],"versions":["0.8.7.6-1","0.8.7.6+git20160220-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7.6+git20160220-3ubuntu0.1~esm1"}]}],"versions":["0.8.7.6-1","0.8.7.6+git20160220-3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-2ubuntu0.1~esm1"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu3","0.9.12-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-1+deb11u1build0.20.04.1"}]}],"versions":["0.9.16-1","0.9.20-1","0.9.24-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"yard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.26-1ubuntu0.1"}]}],"versions":["0.9.24-1","0.9.26-1"],"bundled":3}],"products":[{"vendor":"yardoc","product":"yard"}],"references":[{"url":"https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17042","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gj4p-3wh3-2rmf","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2017-17042.yml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-17042","tags":["advisory"]},{"url":"https://github.com/lsegal/yard","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181890-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1070263","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17042","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-17042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17042","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6731-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-1020001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27285","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-17042","description":"lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.","status":"published","published":"2017-11-28T20:00:00Z","modified":"2024-09-16T17:18:23.027Z","updated_at":"2026-11-02T14:33:17.903346Z"}],"euvd":[{"id":"EUVD-2017-0362","description":"lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.","status":"published","published":"2017-11-28T20:00:00Z","modified":"2024-09-16T17:18:23Z","updated_at":"2026-11-03T00:55:43.455642Z"}],"ghsa":[{"id":"GHSA-gj4p-3wh3-2rmf","title":"Arbitrary file read vulnerability in yard server","description":"`lib/yard/core_ext/file.rb` in the server in YARD before 0.9.11 does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.","status":"published","published":"2017-12-21T00:47:25Z","modified":"2023-07-05T17:53:10Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2017-17042","description":"lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.","status":"published","published":"2017-11-28T20:29:00.337Z","modified":"2026-06-17T01:10:15.667Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"CVE-2017-17042","description":"lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.","status":"published","published":"2017-11-28T20:29:00.337Z","modified":"2026-10-20T10:47:47.523825785Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-17042","description":"lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.","status":"published","published":"2017-11-28T20:29:00.337Z","modified":"2026-09-01T20:03:45.910694976Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"GHSA-gj4p-3wh3-2rmf","title":"Arbitrary file read vulnerability in yard server","description":"`lib/yard/core_ext/file.rb` in the server in YARD before 0.9.11 does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.","status":"published","published":"2017-12-21T00:47:25Z","modified":"2024-02-16T08:20:04.010887Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"UBUNTU-CVE-2017-17042","description":"lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.","status":"published","published":"2017-11-28T20:29:00Z","modified":"2026-02-04T04:19:41.820582Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"openSUSE-SU-2024:11532-1","title":"yast2-buildtools-4.4.1-1.2 on GA media","description":"These are all security issues fixed in the yast2-buildtools-4.4.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:24:15.622474Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:1890-1","title":"Security update for rubygem-yard","description":"This update for rubygem-yard fixes the following issues:\n\n- CVE-2017-17042: The server in YARD did not block relative paths with an\n  initial ../ sequence, which allowed attackers to conduct directory traversal\n  attacks and read arbitrary files (bsc#1070263).\n","status":"published","published":"2018-07-05T15:28:08Z","modified":"2026-02-04T02:55:30.084677Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-6731-1","title":"yard vulnerabilities","description":"It was discovered that YARD before 0.9.11 does not block relative paths\nwith an initial ../ sequence, which allows attackers to conduct\ndirectory traversal attacks and read arbitrary files. This issue only\naffected Ubuntu 16.04 LTS. (CVE-2017-17042)\n\nIt was discovered that yard before 0.9.20 is affected by a path\ntraversal vulnerability, allowing HTTP requests to access arbitrary\nfiles under certain conditions. This issue only affected Ubuntu 18.04\nLTS. (CVE-2019-1020001)\n\nAviv Keller discovered that the \"frames.html\" file within the Yard\nDoc's generated documentation is vulnerable to Cross-Site Scripting\n(XSS) attacks due to inadequate sanitization of user input within the\nJavaScript segment of the \"frames.erb\" template file. (CVE-2024-27285)\n","status":"published","published":"2024-04-15T10:27:32Z","modified":"2026-06-25T13:32:28.72936374Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}