AIKIDO-2026-962241
yard is vulnerable to Path Traversal
39
Low Risk
This Affects:
yardTL;DR
YARD's yard server normalizes incoming HTTP request paths in the router and in the base command before mapping them to documentation files. The prior sanitization relies on File.cleanpath plus a leading ../ regex, which does not neutralize alternate path separators, Windows drive-letter prefixes, UNC prefixes, or rooted paths. On a host serving documentation with a configured document root, a crafted request path can escape the intended directory and read files outside it. The fix adds a centralized Server.clean_path helper that converts separators, strips drive letters and leading roots, and collapses traversal segments.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you serve documentation using yard server.
Background info
yard is vulnerable to Path Traversal in versions 0.9.20 - 0.9.44.
How to fix this
Upgrade the yard library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant