CVE-2017-17042

High

Published: 28/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In YARD versions before 0.9.11, the lib/yard/core_ext/file.rb does not block relative paths starting with the ../ sequence, allowing attackers to conduct directory traversal attacks and read arbitrary files.

Risk Assessment

Attackers may gain access to sensitive files on the server, potentially leading to data exposure or system compromise.

Recommendation

It is recommended to update YARD to version 0.9.11 or later to block the possibility of directory traversal attacks.

Other vulnerabilities in YARD

CVE-2026-49342Medium
YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs, which can lead to the disclosure of HTML files outside the intended static tree.

Original NVD description (English source)

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS