Executive brief
Pagy, a popular Ruby gem for website pagination, contains a vulnerability that allows attackers to probe for the existence of files on the server. By providing a specially crafted language setting, an attacker can force the application to attempt to load arbitrary configuration files. While the contents of these files are not directly displayed to the attacker, the server's response can reveal whether specific files exist or are readable, potentially aiding in further attacks.
Technical details
A path traversal vulnerability exists in Pagy's I18n module where the `locale=` setter fails to sanitize input before using it as a path component. When the application later attempts to load the corresponding dictionary file using `YAML.load_file`, an attacker can use `../` sequences to point the loader at arbitrary `.yml` files on the host system. Although a structural check on the loaded YAML prevents direct content disclosure in the response, the application's error behavior creates a side-channel oracle. Specifically, an attacker can distinguish between a non-existent file (which falls back to default) and an existing, readable file (which triggers a structural validation error), allowing for file-existence and readability probing. The issue is fixed in version 43.5.6 by enforcing a BCP 47 regex pattern on locale inputs.
Affected products
- ddnexus pagy >= 43.0.0, < 43.5.6
Timeline
- 2026-06-08: disclosed
- 2026-07-28: advisory: GitHub Advisory published
- 2026-07-28: patched: Version 43.5.6 released