CVE-2026-54659
Pagy I18n locale option is not validated before being used in a file path
Description
Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.
INFO
Published Date :
July 28, 2026, 11:17 p.m.
Last Modified :
Oct. 23, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update the Pagy gem to version 43.5.6 or later.
- Validate locale parameters to prevent path manipulation.
- Review file access controls for YAML files.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-54659.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-54659 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-54659
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-54659 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-54659 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: pagy de ddnexus, Description: Pagy es paginación agnóstica en Ruby puro. Desde la versión 43.0.0 hasta la 43.5.6, Pagy::I18n.locale= en gem/lib/pagy/modules/i18n/i18n.rb almacenaba los valores de configuración regional textualmente y luego los usaba como componentes de ruta de [locale].yml, permitiendo que valores no confiables de params[:locale] con rutas absolutas o secuencias .. / crearan un oráculo de existencia y legibilidad de archivos para archivos YAML. Este problema está corregido en la versión 43.5.6. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 29, 2026
Action Type Old Value New Value Added Reference https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc Added SSVC {'id': 'CVE-2026-54659', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-29T13:06:55.587193Z'} -
New CVE Received by [email protected]
Jul. 28, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'ddnexus', 'product': 'pagy', 'versions': [{'status': 'affected', 'version': '>= 43.0.0, < 43.5.6'}]}] Added Description Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-22 Added CWE CWE-200 Added Reference https://github.com/ddnexus/pagy/commit/efcf09690e9fa7d7abdfb987b785a55f87e287df Added Reference https://github.com/ddnexus/pagy/pull/908 Added Reference https://github.com/ddnexus/pagy/releases/tag/43.5.6 Added Reference https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc