Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. (CVE-2026-49342)
Description
YARD, a Ruby documentation generation tool, has a vulnerability prior to version 0.9.44 where its static cache lookup reads a request path before the router's path cleanup. This allows a traversal path to access readable sibling .html files outside the intended static directory. The issue is patched in version 0.9.44.
CVSS v3.1
Score 5.3medium
Affected software
pkg:deb/ubuntu/yard?arch=source&distro=esm-apps-legacy/xenialpkg:deb/ubuntu/yard?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/yard?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/yard?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/yard?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/yard?arch=source&distro=questingpkg:deb/ubuntu/yard?arch=source&distro=stonkingpkg:deb/ubuntu/yard?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
YARD versions before 0.9.44 have a security flaw in their static cache lookup mechanism. The lookup reads the request path before the router performs path cleanup, which can lead to directory traversal attacks. Specifically, when a server is configured with a document root, a crafted traversal path such as '/../yard-cache-secret.html' can be joined against the root and cause files outside the intended static tree to be served. This vulnerability was addressed and fixed in version 0.9.44.
Potential Impact
An attacker can exploit this vulnerability to read arbitrary sibling .html files outside the intended static directory served by YARD. This results in unauthorized disclosure of potentially sensitive files. The CVSS score of 5.3 (medium severity) reflects the confidentiality impact without affecting integrity or availability.
Mitigation Recommendations
Upgrade YARD to version 0.9.44 or later, which includes the official fix for this vulnerability. No additional mitigation is required once the patch is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-49342
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f61a2cdf04f656664182
Added to database: 10/17/2026, 22:26:34 UTC
Last enriched: 10/18/2026, 01:03:58 UTC
Last updated: 10/18/2026, 01:03:58 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.