YARD, a Ruby documentation generator maintained by lsegal, includes a static cache used to serve documentation files. In versions before 0.9.44 the cache lookup reads the raw request path before router sanitization, allowing a crafted traversal string such as /../yard-cache-secret.html to resolve to a sibling HTML file outside the intended static tree. The flaw is a directory traversal issue (CWE-22) that can expose arbitrary configuration or documentation files, resulting in information disclosure.

Any deployment of YARD older than 0.9.44 that serves static cache content from a configured document root is affected. The vulnerability applies regardless of the specific server or hosting configuration.

The CVSS score of 5.3 indicates moderate severity, and no EPSS rating is available, so the current likelihood of exploitation is undetermined. The issue is not listed in CISA KEV, implying limited known exploitation. Since the flaw is triggered by an unauthenticated HTTP request path before any authorization checks, an attacker can exploit it remotely or locally without privileged access to read sensitive files.