Arbitrary file read vulnerability in yard server (GHSA-gj4p-3wh3-2rmf)
Published: 2017-12-21T00:47:25Z
Aliases: CVE-2017-17042
Severity: HIGH · CWE: CWE-22

`lib/yard/core_ext/file.rb` in the server in YARD before 0.9.11 does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected packages:
package: ecosystem: RubyGems
name: yard
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.9.11