CVE-2026-54659: Directory Traversal and File Existence Oracle in Pagy I18n module

The affected component is the internationalization (I18n) module of Pagy, a widely used, lightweight pagination gem for the Ruby programming language. The security boundary is breached within the Pagy::I18n.locale= setter, which manages localization lookup tables. Because this setter handles locale assignments globally or thread-locally, applications that pass untrusted user input directly to it expose a critical file system interaction point.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / 'Path Traversal') and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). When exploited, this weakness permits an attacker to escape the intended directory constraint and probe the server filesystem. The attack surface is typically exposed through query parameters or HTTP request headers that configure user language preferences.

Although Pagy enforces structural schema validation on parsed files—which prevents direct retrieval of raw file contents—the application's response variations create a highly reliable file existence and readability oracle. This channel allows attackers to map the existence of configuration files, database configuration files, or other system YAML documents.

The root cause of CVE-2026-54659 is the total absence of input validation or sanitization within the Pagy::I18n.locale= setter method. In vulnerable versions, this method accepts any arbitrary string and writes it directly to the thread-local storage key :pagy_locale.

During translation lookups, the library constructs a file path by appending the user-controlled locale string directly to the localized file directory path. This string interpolation uses a standard file path resolution mechanism, ROOT.join('locales', "#{locale}.yml"). When the input contains path traversal sequences like ../ or absolute path directives, Ruby's Pathname#join resolves the sequence relative to the system root, allowing the path to escape the intended locales directory.

The application subsequently attempts to load the constructed path using the standard Ruby YAML library, specifically YAML.load_file(path). If an application is configured to pass raw user input (such as params[:locale]) directly to the Pagy setter, an attacker can influence the file system path supplied to the parser. The parser then attempts to load any YAML file on the local file system that matches the manipulated path.

To understand the exact mechanics of the vulnerability and its remediation, we must examine the implementation within gem/lib/pagy/modules/i18n/i18n.rb. The vulnerable implementation accepted any string input, converting it directly using to_s and writing it to the thread-local storage context.

# Vulnerable code in gem/lib/pagy/modules/i18n/i18n.rb
def locale=(value)
  Thread.current[:pagy_locale] = value.to_s
end

The corrective patch, introduced in version 43.5.6, implements a strict validation system. The patch introduces a regular expression constant LOCALE_PATTERN conforming to BCP 47/RFC 4647 language tag standards. The setter now uses Ruby's String#[] syntax to slice the string, returning the string if it matches the pattern or nil if it fails validation.

# Patched code in gem/lib/pagy/modules/i18n/i18n.rb
module I18n
  class KeyError < KeyError; end
 
  # Regular expression validating only compliant BCP 47 language tags
  LOCALE_PATTERN = /\A[a-zA-Z]{2,8}(-[a-zA-Z0-9]{1,8})*\z/
 
  extend self
 
  # Assigns a validated locale to the current thread
  def locale=(value)
    Thread.current[:pagy_locale] = value.to_s[LOCALE_PATTERN]
  end
end

This validation pattern restricts acceptable input to letters and hyphens, strictly bound by the start-of-string (\A) and end-of-string (\z) anchors. This prevents multiline bypass attempts and completely blocks traversal characters like / or .. If an attacker attempts to inject a path traversal sequence, the pattern match fails, returning nil. This causes Pagy to fall back safely to the default locale configuration without executing file operations.

An attacker exploits this vulnerability by manipulating the parameter mapped to Pagy::I18n.locale. For example, an HTTP request to GET /items?locale=../../../../config/database causes the application to construct the file path /path/to/app/gem/locales/../../../../config/database.yml. Because Ruby resolves relative path traversals, the engine attempts to parse /path/to/app/config/database.yml.

The exploitation payload relies on side-channel analysis of application errors. If the targeted file does not exist, the framework handles the missing file error internally and falls back to the default locale, resulting in a normal HTTP 200 response. If the target file exists and is a valid YAML configuration, the load succeeds but fails to find the required Pagy localization schema, raising a Pagy::I18n::KeyError and causing an HTTP 500 response.

If the file exists but contains invalid YAML formatting, the Ruby interpreter raises a parsing exception such as Psych::SyntaxError, returning a distinct HTTP 500 error or stack trace. By correlating these application behaviors, an attacker can map file structures, confirm the existence of configuration directories, and locate critical database or credentials files.

A secondary, parallel vulnerability was resolved alongside the path traversal issue within GitHub PR #908. This vulnerability occurs in Pagy's development tool helper (dev_tools), located in gem/lib/pagy/modules/abilities/configurable.rb. The component failed to sanitize or validate the wand_scale parameter, creating an injection vector when exposed to user-controlled values.

# Vulnerable implementation in configurable.rb
def dev_tools(wand_scale: 1)
  <<~HTML
    <script id="pagy-wand" data-scale="#{wand_scale}">
      #{ROOT.join('javascripts/wand.js').read}
    </script>
  HTML
end

If an application exposed this helper parameter directly to query inputs (e.g., Pagy.dev_tools(wand_scale: params[:scale])), an attacker could pass a string containing HTML escape characters. A payload such as 1"></script><script>alert(document.cookie)</script> would successfully break out of the script tag attribute and execute arbitrary JavaScript in the context of the user's browser session.

# Patched implementation in configurable.rb
def dev_tools(wand_scale: 1)
  <<~HTML
    <script id="pagy-wand" data-scale="#{wand_scale.to_f}">
      #{ROOT.join('javascripts/wand.js').read}
    </script>
  HTML
end

The remediation forces numeric type conversion by appending .to_f to the interpolated variable. When Ruby parses a string containing mixed malicious characters using .to_f, it truncates the input at the first non-numeric character. This turns the injection string into a harmless float value (e.g., 1.0), eliminating the cross-site scripting vector entirely.

The primary security impact of CVE-2026-54659 is localized information disclosure and filesystem reconnaissance. An unauthenticated remote attacker can probe the host filesystem to verify the presence of critical system files, framework configurations, and environment-specific database files. This provides the necessary intelligence to construct targeted secondary attacks.

The CVSS v4.0 base score is calculated at 6.9, reflecting a medium-severity profile. The metric string is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. This indicates that while the vulnerability is remotely exploitable without authentication (AV:N/PR:N/UI:N), the impact is confined to low confidentiality loss (VC:L) without administrative modification capabilities or direct system compromise.

In combination with the secondary XSS vector in dev_tools, the overall exposure of unpatched installations is elevated in non-production or development-enabled environments. Developers must recognize that even though raw file content read capabilities are limited by schema validation checks, file existence oracles provide crucial telemetry to attackers mapping application environments.