The ddnexus pagy gem, a Ruby pagination library, contains a path traversal vulnerability (CWE-22) in the Pagy::I18n.locale= method in versions 43.0.0 through 43.5.5. This method stores locale values without sanitization and uses them as components in file paths for YAML locale files. An attacker can supply crafted locale parameters containing absolute paths or '../' sequences to read arbitrary YAML files on the filesystem, creating a file existence and readability oracle. The vulnerability is addressed in version 43.5.6.

An attacker can exploit this vulnerability to read arbitrary YAML files on the server by manipulating the locale parameter. This may lead to information disclosure of sensitive configuration or data files. The CVSS 4.0 base score is 6.9 (medium severity), indicating a network-exploitable vulnerability without required privileges or user interaction, with low impact on confidentiality.

Upgrade to pagy version 43.5.6 or later, where the vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, avoid using untrusted input for locale settings or sanitize inputs to prevent path traversal sequences.