CVE-2017-17042.yml

---
gem: yard
cve: 2017-17042
ghsa: gj4p-3wh3-2rmf
url: https://nvd.nist.gov/vuln/detail/CVE-2017-17042
title: Potential arbitrary file read vulnerability in yard server
date: 2017-11-28
description: |
  lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block
  relative paths with an initial ../ sequence, which allows attackers to conduct
  directory traversal attacks and read arbitrary files.
cvss_v2: 5.0
cvss_v3: 7.5
patched_versions:
  - ">= 0.9.11"