PT-2026-65621 · Rubygems · Pagy

CVE-2026-54659 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pagy versions 43.0.0 through 43.5.5

Description In the Pagy::I18n.locale= setter within gem/lib/pagy/modules/i18n/i18n.rb, locale values are stored verbatim and subsequently used as path components to load YAML dictionary files. When an application assigns unsanitized user input to the locale, such as through the params[:locale] variable, an attacker can use absolute paths or directory traversal sequences (e.g., ../) to redirect the file lookup outside the intended locales directory. While the software's structural checks prevent the file contents from being returned in the response, this behavior creates a file existence and readability oracle for .yml files on the host, as the system's response differs based on whether the targeted file exists and is readable.

Recommendations Update Pagy to version 43.5.6. As a temporary workaround, validate the locale before assignment by applying a BCP 47 shape constraint to the params[:locale] variable or restricting it to a known set of trusted locales.

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2026-54659

GHSA-2XMW-F8J8-WFXC

Affected Products

Pagy

References · 7

• https://osv.dev/vulnerability/GHSA-2xmw-f8j8-wfxc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54659 · Security Note
• https://github.com/ddnexus/pagy/pull/908 · Note
• https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc · Note
• https://github.com/ddnexus/pagy/releases/tag/43.5.6 · Note
• https://github.com/ddnexus/pagy/commit/efcf09690e9fa7d7abdfb987b785a55f87e287df · Note
• https://github.com/ddnexus/pagy · Note