{"answers":{"affected":"2 open source packages ship an affected version, including pagy.","exploited":"There is no known exploitation of CVE-2026-54659 in the wild and no public exploit code.","fix":"Upgrade pagy to 43.5.6 or later.","what":"CVE-2026-54659 is a medium-severity path traversal vulnerability in ddnexus pagy, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-54659 and fix it if it is affected.\n\nWhat it is: CVE-2026-54659 is a medium-severity path traversal vulnerability in ddnexus pagy, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-54659 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- pagy (RubyGems): affected from 43.0.0; fixed in 43.5.6\n- pagy (RubyGems): affected from 43.0.0; fixed in 43.5.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54659/ (Markdown: https://insights.sbomify.com/CVE-2026-54659/index.md)","id":"CVE-2026-54659","markdown":"https://insights.sbomify.com/CVE-2026-54659/index.md","name":"CVE-2026-54659","record":{"aliases":["GHSA-2xmw-f8j8-wfxc","UBUNTU-CVE-2026-54659"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Ruby pagination library","requires_auth":"none","summary":"Attackers can manipulate locale parameters to read arbitrary YAML files via path traversal in the Pagy Ruby library.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as \u003clocale\u003e.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.","ecosystems":["RubyGems"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Pagy I18n locale option is not validated before being used in a file path","id":"CVE-2026-54659","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":2,"n_references":4,"next":{"headline":"swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`","id":"CVE-2026-54660"},"packages":[{"ecosystem":"RubyGems","fixed":["43.5.6"],"introduced":["43.0.0"],"last_affected":[],"package":"pagy","purl":null,"source":"GHSA-2xmw-f8j8-wfxc"},{"ecosystem":"RubyGems","fixed":["43.5.6"],"introduced":["43.0.0"],"last_affected":[],"package":"pagy","purl":"pkg:gem/pagy","source":"GHSA-2xmw-f8j8-wfxc"}],"prev":{"headline":"@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution","id":"CVE-2026-54658"},"products":["pagy"],"published":"2026-07-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-29","vendors":["ddnexus"]},"summary":"Attackers can manipulate locale parameters to read arbitrary YAML files via path traversal in the Pagy Ruby library.","url":"https://insights.sbomify.com/CVE-2026-54659/"}