Back Linuxsecurity

Ubuntu 26.04 YARD Important Network Exposure Vulnerability USN-8394

Linuxsecurity •LinuxSecurity Advisories • June 5, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: YARD could be made to expose sensitive information over the network. Software Description: - yard: A documentation generation tool for the Ruby programming language Details: It was discovered that YARD incorrectly sanitized paths in its built-in documentation server. An attacker could possibly use this issue to read arbitrary files from the server host.

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS yard 0.9.38-1ubuntu0.1~esm1 Available with Ubuntu Pro yard-doc 0.9.38-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS yard 0.9.36-1ubuntu0.1~esm1 Available with Ubuntu Pro yard-doc 0.9.36-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS yard 0.9.26-1ubuntu0.1+esm1 Available with Ubuntu Pro yard-doc 0.9.26-1ubuntu0.1+esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS yard 0.9.24-1+deb11u1ubuntu0.1~esm1 Available with Ubuntu Pro yard-doc 0.9.24-1+deb11u1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS yard 0.9.12-2ubuntu0.1~esm2 Available with Ubuntu Pro yard-doc 0.9.12-2ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS yard 0.8.7.6+git20160220-3ubuntu0.1~esm2 Available with Ubuntu Pro yard-doc 0.8.7.6+git20160220-3ubuntu0.1~esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8394-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical YARD Vulnerability Exposes Sensitive Data in Multiple Ubuntu Releases A significant vulnerability has been identified in YARD, a documentation generation tool for Ruby, affecting multiple Ubuntu LTS releases including 26.04, 24.04, 22.04, 20.04, 18.04, and 16.04. The flaw allows attackers to read arbitrary files from the server host due to improper path sanitization in YARD's built-in documentation server. This issue could lead to the exposure of sensitive information over the network. Users are advised to update their systems to the specified package versions to mitigate the risk. The vulnerability has been assigned the identifier USN-8394-1. A standard system update will apply the necessary patches. Ubuntu Pro users have access to extended security maintenance for affected packages. The current status is that the vulnerability has been disclosed, and updates are available. 2 sources 71

Extracted Entities

Ubuntu 26.04 YARD Important Network Exposure Vulnerability USN-8394

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

IP Addresses (1)

Platforms (1)