Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
YARD 安全漏洞
Vulnerability Description
YARD是一款Ruby编程语言的文档生成工具。该工具能够生成多种格式的文档。 YARD 0.9.11之前版本中的服务器的lib/yard/core_ext/file.rb文件存在安全漏洞，该漏洞源于程序没有阻止以‘../’序列开头的相关路径。攻击者可利用该漏洞读取任意文件。
CVSS Information
N/A
Vulnerability Type
N/A