Critical YARD Vulnerability Exposes Sensitive Data in Multiple Ubuntu Releases

A significant vulnerability has been identified in YARD, a documentation generation tool for Ruby, affecting multiple Ubuntu LTS releases including 26.04, 24.04, 22.04, 20.04, 18.04, and 16.04. The flaw allows attackers to read arbitrary files from the server host due to improper path sanitization in YARD's built-in documentation server. This issue could lead to the exposure of sensitive information over the network. Users are advised to update their systems to the specified package versions to mitigate the risk. The vulnerability has been assigned the identifier USN-8394-1. A standard system update will apply the necessary patches. Ubuntu Pro users have access to extended security maintenance for affected packages. The current status is that the vulnerability has been disclosed, and updates are available.

Key Points: • YARD vulnerability affects multiple Ubuntu LTS releases from 16.04 to 26.04. • Improper path sanitization allows attackers to read arbitrary files from the server. • Users are urged to update their systems to the latest package versions to mitigate risks.