CVE-2026-54659CWE-200CWE-22path-traversalinformation-disclosure

CVE-2026-54659

published July 29, 2026

CVSS
6.9
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00540 · 44.6th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-29T03:17Z
References (5)
https://github.com/ddnexus/pagy/commit/efcf09690e9fa7d7abdfb987b785a55f87e287df · [email protected]https://github.com/ddnexus/pagy/pull/908 · [email protected]https://github.com/ddnexus/pagy/releases/tag/43.5.6 · [email protected]https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc · [email protected]https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 JUL 22:25Z
    Pagy I18n locale option is not validated before being used in a file path
    cvelistv5