CVE-2026-49342

What it actually does

YARD versions prior to 0.9.44 can serve files outside the intended static documentation directory when the static cache lookup processes the raw request path before router path normalization. If a YARD documentation server is configured with a document root, an unauthenticated remote requester can use directory traversal sequences such as `/../` to cause the server to join the path against the document root and return readable sibling `.html` files that should not be exposed. The impact is limited to unauthorized read access to reachable HTML files; the vulnerability does not directly enable file modification, code execution, or service disruption.

Why it matters to the business

Organizations exposing YARD-generated documentation or YARD documentation servers could unintentionally disclose internal or adjacent HTML content, such as generated documentation pages, cached documentation artifacts, build outputs, or other readable HTML files placed near the configured document root. The CVSS score is moderate and EPSS is currently low, with no known KEV listing or reported exploit maturity, but internet-exposed documentation endpoints should still be fixed because exploitation is simple, unauthenticated, and low-noise.

How an attack unfolds

An attacker first identifies an exposed YARD documentation server or application endpoint serving YARD static documentation. They then send crafted HTTP requests containing path traversal segments, commonly using `/../`, targeting likely sibling HTML files outside the configured static document tree. Because vulnerable versions perform static cache lookup before path cleanup, the traversal path can be joined with the document root and resolved to a readable `.html` file outside the intended directory. If the guessed file exists and the server process can read it, the attacker receives its contents in the HTTP response. The attacker can repeat this process with variations of filenames and encoded traversal sequences to enumerate accessible HTML artifacts.

How to fix it

Upgrade YARD to version 0.9.44 or later. If YARD is bundled through a Ruby application, update the relevant Gemfile or dependency lockfile and redeploy the application or documentation service. As compensating controls, restrict access to YARD documentation endpoints, place them behind authentication or VPN access, disable public serving of generated documentation where not required, and configure the web server or reverse proxy to reject path traversal sequences before requests reach YARD. Ensure no sensitive HTML artifacts are stored as siblings of the YARD document root.

How to confirm the fix worked

Confirm that deployed Ruby dependencies resolve to YARD 0.9.44 or later, for example by checking `bundle list`, `bundle info yard`, `gem list yard`, or the application lockfile. Test exposed documentation endpoints with benign traversal probes such as requests containing `/../` followed by a known non-sensitive sibling `.html` test file; a fixed deployment should not return files outside the intended static tree. Review web server and application routing behavior to ensure encoded traversal forms are also rejected or normalized. Verify that reverse proxy, CDN, and application caches do not continue serving previously exposed content.

Typical attack path

1. Identify an exposed YARD documentation server or application endpoint serving YARD-generated static content.
2. Confirm the endpoint responds to static documentation requests.
3. Send crafted HTTP GET requests containing traversal sequences such as `/../` before a target `.html` filename.
4. Observe whether the server returns an unexpected HTML file rather than rejecting or normalizing the path.
5. Iterate over likely sibling HTML filenames, cached documentation files, or generated documentation artifacts to collect exposed content.

How to detect it

Review HTTP access logs from web servers, reverse proxies, CDNs, load balancers, and Ruby application logs serving YARD documentation. Look for requests containing traversal sequences such as `/../` or encoded variants, especially when followed by `.html` filenames, and correlate them with HTTP 200 responses or unusually sized successful responses. Investigate repeated requests for guessed documentation, cache, or sibling HTML filenames from the same source IP, user agent, or session. Check whether any successful response served content outside the configured documentation root by comparing requested paths, normalized filesystem paths, and response byte counts. If available, inspect WAF logs for path traversal rule matches and application logs for static file reads or cache lookups involving unresolved `..` path segments. Because no public exploit maturity or named threat actor activity is currently reported, prioritize evidence of suspicious traversal probing and successful file disclosure rather than relying on known malware artifacts.

• GET /../
• POST /../
• /%2e%2e/
• /%2E%2E/
• /..%2f
• /%2e%2e%2f
• /%252e%252e%252f
• /../yard-cache-secret.html
• yard-cache-secret.html
• ../*.html
• %2e%2e%2f*.html

What your security team should do

• Inventory internet-facing and internally exposed YARD documentation servers or Ruby applications that serve YARD-generated documentation.
• Prioritize upgrade of YARD to 0.9.44 or later for any exposed service.
• Restrict documentation endpoints to trusted users or networks, especially for internal API or code documentation.
• Add web server, WAF, or reverse proxy rules to block traversal attempts containing `/../`, encoded dot-dot sequences, or suspicious requests for sibling `.html` files.
• Search recent HTTP access logs for traversal attempts against YARD documentation paths and investigate any successful 200 responses.
• Review adjacent files around YARD document roots and remove sensitive generated HTML or build artifacts that do not need to be served.
• After remediation, run validation tests against both direct application endpoints and any CDN or reverse-proxy front doors.