CVE-2026-41493: yard: Possible arbitrary path traversal and file access via yard server
Last updated 6 June 2026
Other sources
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41493?
CVE-2026-41493 is categorized as a medium severity vulnerability due to its potential for arbitrary file access.
How do I fix CVE-2026-41493?
To fix CVE-2026-41493, upgrade YARD to version 0.9.42 or later.
What is the affected software for CVE-2026-41493?
CVE-2026-41493 affects YARD versions prior to 0.9.42.
What type of vulnerability is CVE-2026-41493?
CVE-2026-41493 is a path traversal vulnerability affecting the YARD documentation server.
Can CVE-2026-41493 be exploited remotely?
Yes, CVE-2026-41493 can be exploited remotely through unsanitized HTTP requests.