https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 30 Jul 2026 21:43:47 +0000 https://vulnerability.circl.lu/sighting/0ded817a-1231-4ca5-bab0-cf27a0284750/export {"uuid": "0ded817a-1231-4ca5-bab0-cf27a0284750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54659", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqyur5xl32i", "content": "CVE-2026-54659 - Pagy I18n locale option is not validated before being used in a file path\nCVE ID : CVE-2026-54659\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 23\u00a0minutes ago\n \n Description : Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18...", "creation_timestamp": "2026-07-29T03:39:55.820389Z"} {"uuid": "0ded817a-1231-4ca5-bab0-cf27a0284750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54659", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqyur5xl32i", "content": "CVE-2026-54659 - Pagy I18n locale option is not validated before being used in a file path\nCVE ID : CVE-2026-54659\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 23\u00a0minutes ago\n \n Description : Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18...", "creation_timestamp": "2026-07-29T03:39:55.820389Z"} https://vulnerability.circl.lu/sighting/0ded817a-1231-4ca5-bab0-cf27a0284750/export Wed, 29 Jul 2026 03:39:55 +0000 https://vulnerability.circl.lu/sighting/3e1ce8da-1301-4c1b-ba98-973479f8deae/export {"uuid": "3e1ce8da-1301-4c1b-ba98-973479f8deae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54659", "type": "published-proof-of-concept", "source": "https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc", "content": "", "creation_timestamp": "2026-07-29T00:35:03.227281Z"} {"uuid": "3e1ce8da-1301-4c1b-ba98-973479f8deae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54659", "type": "published-proof-of-concept", "source": "https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc", "content": "", "creation_timestamp": "2026-07-29T00:35:03.227281Z"} https://vulnerability.circl.lu/sighting/3e1ce8da-1301-4c1b-ba98-973479f8deae/export Wed, 29 Jul 2026 00:35:03 +0000 https://vulnerability.circl.lu/sighting/37d588ec-b9eb-475f-a841-23d2ad0eb5e2/export {"uuid": "37d588ec-b9eb-475f-a841-23d2ad0eb5e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54659", "type": "seen", "source": "https://gist.github.com/alon710/3def853e2525c617d6890d62679fbc37", "content": "# CVE-2026-54659: CVE-2026-54659: Directory Traversal and File Existence Oracle in Pagy I18n module\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54659\n\n## Summary\nPagy, an agile pagination gem for plain Ruby, contains a directory traversal vulnerability in its internationalization (I18n) module prior to version 43.5.6. An unauthenticated remote attacker can exploit this flaw by submitting path traversal sequences to the locale setter, allowing them to probe the server filesystem. The resulting behavior creates a highly reliable file existence and readability side-channel oracle for YAML files.\n\n## TL;DR\nA path traversal flaw in Pagy's I18n locale setter enables unauthenticated remote attackers to determine the existence and validity of YAML configuration files on the host filesystem via a side-channel oracle.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-200\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **Exploit Status**: Proof of Concept / Patch Available\n- **Impact**: Local File Existence Reconnaissance & XSS\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pagy pagination Ruby gem\n- **pagy**: >= 43.0.0, < 43.5.6 (Fixed in: `43.5.6`)\n\n## Mitigation\n\n- Sanitize the language request parameters against a strict, predefined language whitelist.\n- Prevent users from directly modifying application-level variables used in filesystem paths.\n- Deploy WAF rules to detect path traversal sequences (e.g., ../) in application query parameters.\n\n**Remediation Steps:**\n1. Open the application Gemfile and locate the 'pagy' gem entry.\n2. Update the version definition to target at least version 43.5.6: `gem 'pagy', '>= 43.5.6'`\n3. Execute `bundle update pagy` in the terminal to fetch and apply the updated dependency.\n4. Review custom controllers to ensure request parameters mapped to `Pagy::I18n.locale` undergo explicit whitelisting check if possible.\n\n## References\n\n- [Fix Commit](https://github.com/ddnexus/pagy/commit/efcf09690e9fa7d7abdfb987b785a55f87e287df)\n- [Pull Request #908](https://github.com/ddnexus/pagy/pull/908)\n- [Release Notes](https://github.com/ddnexus/pagy/releases/tag/43.5.6)\n- [GitHub Security Advisory](https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54659) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T00:31:42.718483Z"} {"uuid": "37d588ec-b9eb-475f-a841-23d2ad0eb5e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54659", "type": "seen", "source": "https://gist.github.com/alon710/3def853e2525c617d6890d62679fbc37", "content": "# CVE-2026-54659: CVE-2026-54659: Directory Traversal and File Existence Oracle in Pagy I18n module\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54659\n\n## Summary\nPagy, an agile pagination gem for plain Ruby, contains a directory traversal vulnerability in its internationalization (I18n) module prior to version 43.5.6. An unauthenticated remote attacker can exploit this flaw by submitting path traversal sequences to the locale setter, allowing them to probe the server filesystem. The resulting behavior creates a highly reliable file existence and readability side-channel oracle for YAML files.\n\n## TL;DR\nA path traversal flaw in Pagy's I18n locale setter enables unauthenticated remote attackers to determine the existence and validity of YAML configuration files on the host filesystem via a side-channel oracle.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-200\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **Exploit Status**: Proof of Concept / Patch Available\n- **Impact**: Local File Existence Reconnaissance & XSS\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pagy pagination Ruby gem\n- **pagy**: >= 43.0.0, < 43.5.6 (Fixed in: `43.5.6`)\n\n## Mitigation\n\n- Sanitize the language request parameters against a strict, predefined language whitelist.\n- Prevent users from directly modifying application-level variables used in filesystem paths.\n- Deploy WAF rules to detect path traversal sequences (e.g., ../) in application query parameters.\n\n**Remediation Steps:**\n1. Open the application Gemfile and locate the 'pagy' gem entry.\n2. Update the version definition to target at least version 43.5.6: `gem 'pagy', '>= 43.5.6'`\n3. Execute `bundle update pagy` in the terminal to fetch and apply the updated dependency.\n4. Review custom controllers to ensure request parameters mapped to `Pagy::I18n.locale` undergo explicit whitelisting check if possible.\n\n## References\n\n- [Fix Commit](https://github.com/ddnexus/pagy/commit/efcf09690e9fa7d7abdfb987b785a55f87e287df)\n- [Pull Request #908](https://github.com/ddnexus/pagy/pull/908)\n- [Release Notes](https://github.com/ddnexus/pagy/releases/tag/43.5.6)\n- [GitHub Security Advisory](https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54659) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T00:31:42.718483Z"} https://vulnerability.circl.lu/sighting/37d588ec-b9eb-475f-a841-23d2ad0eb5e2/export Wed, 29 Jul 2026 00:31:42 +0000