EUVD-2026-342314

fkie_cve-2026-54659

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.

GHSA-2xmw-f8j8-wfxc — Pagy I18n locale option is not validated before being used in a file path

Affected: RubyGems: pagy

### Summary

`Pagy::I18n.locale=` did not validate its argument before using it as a path component to load the matching dictionary file (`<locale>.yml`). An application that assigns untrusted input to the locale — e.g. the common pattern `Pagy::I18n.locale = params[:locale]` — let that input influence which file Pagy attempted to load.

### Details

The setter stored the value as-is, and the loader joined it into a path and read it:

```ruby # gem/lib/pagy/modules/i18n/i18n.rb def locale=(value) Thread.current[:pagy_locale] = value.to_s end

# ...later, when translating: path = pathnames.reverse.map { |p| p.join("#{locale}.yml") }.find(&:exist?) dictionary = YAML.load_file(path)[locale] ```

Because the locale was used verbatim, a value such as an absolute path or a `../`-style string redirected the lookup outside the locales directory. Pagy's subsequent structural check (`dictionary['pagy']['p11n']`) prevents the file's contents from being returned, so this is **not** a direct file read.

Fixed in 43.5.6 by constraining the locale to a BCP 47 shape before use:

```ruby LOCALE_PATTERN = /\A[a-zA-Z]{2,8}(-[a-zA-Z0-9]{1,8})*\z/

def locale=(value) Thread.current[:pagy_locale] = value.to_s[LOCALE_PATTERN] end ```

Any non-matching value (including `nil`) resolves to the default locale and never reaches the file lookup.

### PoC

In an application that sets `Pagy::I18n.locale = params[:locale]`, the loader appends `.yml` and reads `<locale>.yml`, so the request param contro…

Most recent entries from all

EUVD-2026-342314

fkie_cve-2026-54659

GHSA-2xmw-f8j8-wfxc — Pagy I18n locale option is not validated before being used in a file path