CVE-2026-49342

Name of the Vulnerable Software and Affected Versions YARD versions prior to 0.9.44

Description YARD is a documentation generation tool for the Ruby programming language. The static cache lookup reads a request path before the router's path cleanup process occurs. When a server is configured with a document root, a traversal path such as '/../yard-cache-secret.html' can be joined against that root, allowing the return of a readable sibling .html file located outside the intended static tree.

Recommendations Update to version 0.9.44.