Medium, CVSS 6.9RubyGemsAmendedPublished
Pagy I18n locale option is not validated before being used in a file path
CVE-2026-54659 · GHSA-2xmw-f8j8-wfxc
- Affected
- RubyGems pagy >= 43.0.0, < 43.5.6
- Fixed in
- 43.5.6· Vendor fix available
- Issue
- Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file (<locale.yml). An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params[:locale] — let that input influence which file Pagy attempted to load. Details The setter stored the value as-is, and the loader joined it into a path and read it: Because the locale was used verbatim, a value such as an absolute path or a ../-style string redirected the lookup outside the locales directory. Pagy's subsequent structural check (dictionary['pagy']['p11n']) prevents the file's contents from being returned, so this is not a direct file read. Fixed in 43.5.6 by constraining the locale to a BCP 47 shape before use: Any non-matching value (including nil) resolves to the default locale and never reaches the file lookup. PoC In an application that sets Pagy::I18n.locale = params[:locale], the loader appends .yml and reads…
Recommended action: Upgrade to 43.5.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.