Pagy::I18n.locale= assigns locale strings directly to a configuration variable and later concatenates the value into a <locale>.yml path. Because no validation or sanitization occurs, an attacker can supply a locale string that contains an absolute path or path traversal sequence. When the gem attempts to load the corresponding YML file, it is able to reveal whether that file exists and is readable, creating a file existence and readability oracle. The flaw does not allow arbitrary code execution or denial of service but enables attackers to discover the presence of sensitive configuration or other readable files on the system.

The vulnerability affects the ddnexus Pagy pagination library for Ruby. Versions from 43.0.0 up to and including 43.5.6 are impacted. Any Ruby application that uses one of these Pagy releases and allows external input to be assigned to I18n.locale, such as web applications or APIs handling user-provided locale parameters, is at risk.

With a CVSS score of 6.9 the flaw represents moderate severity. The EPSS score of less than 1% indicates that active exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is the injection of a crafted locale value via a web request or API endpoint that does not perform input validation. Successful exploitation would allow an attacker to discover whether arbitrary files are present and readable, potentially leading to the exposure of configuration secrets or other sensitive data.