CVE-2026-49342: YARD Path Traversal Vulnerability

CVE-2026-49342 Overview

YARD is a documentation generation tool for the Ruby programming language. CVE-2026-49342 is a path traversal vulnerability [CWE-22] affecting YARD versions prior to 0.9.44. The flaw exists in YARD's static cache lookup, which reads a request path before the router executes its path cleanup routine. When the server is configured with a document root, a crafted traversal path such as /../yard-cache-secret.html is joined against that root and returns a readable sibling .html file outside the intended static tree. The maintainers fixed the issue in version 0.9.44.

Critical Impact
Unauthenticated remote attackers can read arbitrary .html files outside the documentation root on servers running vulnerable YARD instances with static caching enabled.

Affected Products

YARD (Ruby documentation generator) versions prior to 0.9.44
YARD server component with static caching enabled
Ruby applications bundling vulnerable YARD as a dependency

Discovery Timeline

2026-06-19 - CVE-2026-49342 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49342

Vulnerability Analysis

The vulnerability resides in YARD's server static caching layer, implemented in lib/yard/server/static_caching.rb. The static cache lookup reads the raw HTTP request path and joins it against the configured document root before the router's normalization logic runs. Because the order of operations places the cache lookup ahead of path sanitization, traversal sequences such as ../ are honored when constructing the filesystem path. An attacker requesting /../yard-cache-secret.html causes the server to resolve a sibling file outside the intended cache directory and return its contents. Exploitation requires only a network-reachable YARD server with static caching enabled and a document root that has readable sibling .html files. The flaw discloses file contents but does not allow writing or code execution, and it is limited to files with the expected static cache extension.

Root Cause

The root cause is missing path canonicalization in the static cache lookup. The cache handler builds a filesystem path by directly concatenating the user-supplied request path with the document root, without rejecting or resolving .. segments. The router contains cleanup logic, but it runs after the cache layer has already serviced the request.

Attack Vector

An unauthenticated remote attacker sends an HTTP GET request containing path traversal sequences to a YARD server with static caching enabled. The server resolves the traversal against the document root and returns the contents of a sibling .html file outside the intended static tree.

ruby

# Patch excerpt from lib/yard/server/static_caching.rb
# frozen_string_literal: true
+require 'fileutils'
+
 module YARD
   module Server
     # Implements static caching for requests.

Source: GitHub Commit f78c19f

The patch relocates the fileutils requirement and adjusts the static caching module so that path resolution occurs through safe filesystem helpers, ensuring traversal sequences cannot escape the document root.

Detection Methods for CVE-2026-49342

Indicators of Compromise

HTTP request logs containing .. or URL-encoded %2e%2e sequences directed at YARD server endpoints.
Successful 200 responses for paths containing /../ followed by .html filenames not part of the documentation tree.
Unexpected access patterns targeting filenames adjacent to the configured YARD document root.

Detection Strategies

Inspect web server and reverse proxy access logs for traversal patterns against routes served by YARD.
Compare requested paths against the canonical YARD documentation tree and alert on resolutions outside the expected directory.
Enumerate Ruby dependency manifests (Gemfile.lock) across hosts to identify YARD versions below 0.9.44.

Monitoring Recommendations

Enable verbose request logging on internet-exposed YARD servers and forward logs to a centralized analytics platform.
Alert on anomalous file reads from directories adjacent to the YARD document root.
Monitor for repeated 200 responses to requests containing encoded traversal payloads.

How to Mitigate CVE-2026-49342

Immediate Actions Required

Upgrade YARD to version 0.9.44 or later across all environments that run the YARD server component.
Audit deployments to confirm whether static caching is enabled and whether the YARD server is exposed to untrusted networks.
Restrict access to YARD documentation servers behind authentication or VPN where feasible.

Patch Information

The fix is provided in YARD 0.9.44. Review the GitHub Security Advisory GHSA-pxcc-8665-phx8 and the corresponding upstream commit for details on the patched static caching logic.

Workarounds

Disable YARD's static caching feature until upgrading to 0.9.44 is possible.
Place a reverse proxy in front of the YARD server that normalizes request paths and rejects .. sequences before forwarding.
Run the YARD server in a directory with no sensitive sibling .html files to limit the impact of traversal.

bash

# Update YARD to the patched version using Bundler
bundle update yard --conservative

# Verify the installed version is 0.9.44 or later
bundle exec yard --version