CyberRota Analysis
AI-GeneratedThe vulnerability affects the Pagy pagination library in Ruby, specifically versions 43.0.0 to 43.5.6, where the handling of locale values can lead to unauthorized access to YAML files through manipulated parameters. This flaw allows attackers to exploit the system by leveraging absolute paths or directory traversal sequences, potentially exposing sensitive file information. Organizations using affected versions of Pagy should prioritize updating to version 43.5.6 to mitigate the risk of file exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.