YARD, a Ruby documentation generator, has a path traversal flaw that allows an unsanitized HTTP request to read any file on the server hosting the yard server. The vulnerability can be triggered by sending specially crafted URLs to the documentation server before version 0.9.42, resulting in exposure of sensitive system files and confidential information. The weakness is a classic directory traversal condition classified as CWE‑22.

The affected product is lsegal’s YARD documentation tool. Versions earlier than 0.9.42 are vulnerable; the fix was introduced in release 0.9.42. Any deployment that runs a yard server with an unsecured network path is at risk.

The CVSS score of 6.9 places the condition in the moderate severity range, and because the EPSS score is not available, the likelihood of exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. Based on the description, it is inferred that attackers must be able to send HTTP requests to the yard server, which is commonly exposed on the web or internal network. Successful exploitation would grant read access to arbitrary files on the host, potentially enabling further privilege escalation or data exfiltration.