high
7.5
CWE
22
Advisory Published
CVE Published
Updated

CVE-2019-1020001: Path Traversal

First published: Tue Jul 02 2019(Updated: )

## Possible arbitrary path traversal and file access via `yard server` ### Impact A path traversal vulnerability was discovered in YARD <= 0.9.19 when using `yard server` to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability. ### Patches Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments. ### Workarounds For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via `yard server -s webrick`), as can certain rules in your webserver configuration.

Credit: josh@bress.net josh@bress.net

Affected SoftwareAffected VersionHow to fix
Yardoc Yard<0.9.20
rubygems/yard<0.9.20
0.9.20
debian/yard<=0.9.16-1
0.9.16-1+deb10u1
0.9.24-1
0.9.24-1+deb11u1
0.9.28-2
0.9.28-2+deb12u2
0.9.36-1
ubuntu/yard<0.9.12-2ubuntu0.1~
0.9.12-2ubuntu0.1~

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2019-1020001?

    CVE-2019-1020001 has a medium severity rating due to its potential impact on file access.

  • How do I fix CVE-2019-1020001?

    To fix CVE-2019-1020001, upgrade to YARD version 0.9.20 or later.

  • Which versions of YARD are affected by CVE-2019-1020001?

    YARD versions prior to 0.9.20 are affected by CVE-2019-1020001.

  • What type of vulnerability is CVE-2019-1020001?

    CVE-2019-1020001 is a path traversal vulnerability that allows arbitrary file access.

  • How does CVE-2019-1020001 affect HTTP requests?

    CVE-2019-1020001 allows unsanitized HTTP requests made to the yard server to access arbitrary files.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203