Github · Jekyll · CVE-2018-17567
**Name of the Vulnerable Software and Affected Versions**
Jekyll versions 3.6.2 and earlier, 3.7.x through 3.7.3, 3.8.x through 3.8.3
**Description**
The issue allows attackers to access arbitrary files by specifying a symlink in the `include` key in the ` config.yml` file.
**Recommendations**
For Jekyll versions 3.6.2 and earlier, update to a version later than 3.6.2.
For Jekyll versions 3.7.x through 3.7.3, update to a version later than 3.7.3.
For Jekyll versions 3.8.x through 3.8.3, update to a version later than 3.8.3.
As a temporary workaround, consider restricting access to the ` config.yml` file to minimize the risk of exploitation.