Hi security team, As per the below links, Yelp has serious file read vulnerability. Upstream yet to patch although reporter proposed patches. https://www.phoronix.com/news/GNOME-Yelp-Security-Issue-2025 https://blogs.gnome.org/mcatanzaro/2025/04/15/dangerous-arbitrary-file-read-vulnerability-in-yelp-cve-2025-3155/
Upstream report: https://gitlab.gnome.org/GNOME/yelp/-/issues/221 "Since Yelp accepts absolute paths in ghelp URLs, If an attacker can put index.page in any directory on User's filesystem, They can trigger Yelp to show the page if Victim opens a malicious ghelp URL." https://gist.github.com/parrot409/e970b155358d45b298d7024edd9b17f2 "The innovation there is to use /proc/self/cwd to bypass the limitation that the attacker must be able to guess the user's home directory name"
