{"id":"UBUNTU-CVE-2026-54659","details":"Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as \u003clocale\u003e.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.","modified":"2026-10-17T13:00:25.904050181Z","published":"2026-07-28T23:17:00Z","upstream":["CVE-2026-54659"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-54659"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-54659"},{"type":"REPORT","url":"https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc"},{"type":"REPORT","url":"https://github.com/ddnexus/pagy/pull/908"},{"type":"REPORT","url":"https://github.com/ddnexus/pagy/commit/efcf09690e9fa7d7abdfb987b785a55f87e287df"},{"type":"REPORT","url":"https://github.com/ddnexus/pagy/releases/tag/43.5.6"}],"affected":[{"package":{"name":"ruby-pagy","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/ruby-pagy?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["43.5.6-2","43.6.1-1"],"ecosystem_specific":{"binaries":[{"binary_version":"43.6.1-1","binary_name":"ruby-pagy"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54659.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}