Read the docs
TI-2019-16079 Aliases CVE-2019-1020001GHSA-xfhh-rx56-rxcr

yard before 0.9.20 allows path traversal.

Priority LOW 37CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

yard before 0.9.20 allows path traversal.

Why it matters now

EPSS 0.02334 83rd percentileScored 2026-11-07
Fix Fixed yard (yard): 0.9.20yard (RubyGems): 0.9.20

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
yardyardbefore 0.9.200.9.20Patch availableCNA
—yard (RubyGems)before 0.9.200.9.20Patch availableGHSA-xfhh-rx56-rxcr
  • yard Vendoryard Affected before 0.9.20 Fixed in 0.9.20 Patch available CNA
  • yard (RubyGems) Vendor— Affected before 0.9.20 Fixed in 0.9.20 Patch available GHSA-xfhh-rx56-rxcr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:yardoc:yard:*:*:*:*:*:*:*:*before 0.9.20VulnerableYardoc
  • cpe:2.3:a:yardoc:yard:*:*:*:*:*:*:*:* Versions before 0.9.20 Vulnerable ·Yardoc

Remediation

  • Fix · CNA yard (yard) Fixed in 0.9.20
  • Fix · GHSA-xfhh-rx56-rxcr yard (RubyGems) Fixed in 0.9.20 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1020001
  2. 2026-10-03 Alias added: GHSA-xfhh-rx56-rxcr

References

Advisory 3

Other 1

  • TI-2024-18124 YARD's default template vulnerable to Cross-site Scripting in generated frames.html CVSS 3.1MEDIUM 6.1
  • TI-2017-12509 lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative… CVSS 3.0HIGH 7.5
  • TI-2026-30080 yard: Possible arbitrary path traversal and file access via yard server CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences