CVE-2026-54659

Received Received - Intake

Path Traversal in Pagy Ruby Gem

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-54659

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Pagy gem, which is used for pagination in Ruby applications. It allows untrusted input in the locale parameter to be used as a file path, potentially exposing YAML files on the system.

Detection Guidance

This vulnerability involves Pagy's I18n module improperly handling locale parameters, allowing path traversal. Detection requires checking if your application uses Pagy versions between 43.0.0 and 43.5.6. Inspect Gemfile.lock or run 'gem list pagy' to verify the installed version.

Impact Analysis

An attacker could exploit this to read sensitive YAML configuration files on the server, potentially exposing secrets, API keys, or other confidential data stored in those files.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements, potentially resulting in legal penalties or compliance violations.

Mitigation Strategies

Upgrade Pagy to version 43.5.6 or later immediately. If using Bundler, run 'bundle update pagy'. If not, use 'gem install pagy -v 43.5.6'. Review any custom locale handling in your application to ensure safe parameter usage.

Hi! I’m here to help you understand CVE-2026-54659. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70