CVE-2026-41493 describes a path traversal vulnerability in the YARD Ruby documentation tool before version 0.9.42. The flaw occurs in the 'yard server' component, which serves documentation over HTTP. Due to insufficient sanitization of HTTP request paths, an attacker can craft requests that traverse directories and access files outside the intended documentation directory. This could lead to unauthorized disclosure of sensitive files on the server hosting the yard server. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. The issue was fixed in YARD version 0.9.42.

Exploitation of this vulnerability allows an unauthenticated remote attacker to read arbitrary files on the server running the yard server, potentially exposing sensitive information. There is no indication of privilege escalation or code execution. No known exploits in the wild have been reported.

Upgrade YARD to version 0.9.42 or later, where this path traversal vulnerability has been patched. Since this is a self-hosted tool, users must apply the update themselves. Patch status is confirmed by the vendor advisory stating the issue is fixed in 0.9.42.