DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54659: CVE-2026-54659: Directory Traversal and File Existence Oracle in Pagy I18n module

#security #cve #cybersecurity

CVE-2026-54659: Directory Traversal and File Existence Oracle in Pagy I18n module

Vulnerability ID: CVE-2026-54659
CVSS Score: 6.9
Published: 2026-07-28

Pagy, an agile pagination gem for plain Ruby, contains a directory traversal vulnerability in its internationalization (I18n) module prior to version 43.5.6. An unauthenticated remote attacker can exploit this flaw by submitting path traversal sequences to the locale setter, allowing them to probe the server filesystem. The resulting behavior creates a highly reliable file existence and readability side-channel oracle for YAML files.

TL;DR

A path traversal flaw in Pagy's I18n locale setter enables unauthenticated remote attackers to determine the existence and validity of YAML configuration files on the host filesystem via a side-channel oracle.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22, CWE-200
  • Attack Vector: Network (Unauthenticated)
  • CVSS v4.0 Score: 6.9 (Medium)
  • Exploit Status: Proof of Concept / Patch Available
  • Impact: Local File Existence Reconnaissance & XSS
  • CISA KEV Status: Not Listed

Affected Systems

  • Pagy pagination Ruby gem
  • pagy: >= 43.0.0, < 43.5.6 (Fixed in: 43.5.6)

Code Analysis

Commit: efcf096

Fix locale traversal path and wand_scale injection in dev_tools

@@ -1,5 +1,7 @@
-  def locale=(value)
-    Thread.current[:pagy_locale] = value.to_s
-  end
+  LOCALE_PATTERN = /\A[a-zA-Z]{2,8}(-[a-zA-Z0-9]{1,8})*\z/
+
+  def locale=(value)
+    Thread.current[:pagy_locale] = value.to_s[LOCALE_PATTERN]
+  end
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Sanitize the language request parameters against a strict, predefined language whitelist.
  • Prevent users from directly modifying application-level variables used in filesystem paths.
  • Deploy WAF rules to detect path traversal sequences (e.g., ../) in application query parameters.

Remediation Steps:

  1. Open the application Gemfile and locate the 'pagy' gem entry.
  2. Update the version definition to target at least version 43.5.6: gem 'pagy', '>= 43.5.6'
  3. Execute bundle update pagy in the terminal to fetch and apply the updated dependency.
  4. Review custom controllers to ensure request parameters mapped to Pagy::I18n.locale undergo explicit whitelisting check if possible.

References

Read the full report for CVE-2026-54659 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)