CVE-2026-95813 Details
Description
e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query parameters that are interpreted as URL generation options, causing pagination links to point to malicious domains while the initial page loads from the legitimate site.
A vulnerability exists in e621ng versions prior to 26.09.16, where untrusted request parameters are directly passed to Rails' url_for method. This issue is present in the PaginatorComponent and controller navigation links. The flaw allows attackers to manipulate pagination and navigation controls, redirecting them to malicious origins. By supplying specific host, protocol, and port query parameters, attackers can craft URLs that lead users to harmful sites while appearing to originate from the legitimate e621ng domain.
Users can update to e621ng version 26.09.16 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/e621ng/e621ng | [email protected] | Vendor |
| https://github.com/e621ng/e621ng/blob/26.09.02/app/components/paginator_component.rb | [email protected] | Source CodeVendor |
| https://github.com/e621ng/e621ng/commit/e1a3930bf1750b02a23843ec88c33e2aa06e2a5e | [email protected] | Source CodeVendor |
| https://github.com/e621ng/e621ng/pull/2518 | [email protected] | Issue TrackingVendor |
| https://github.com/e621ng/e621ng/releases/tag/26.09.16 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/e621ng-before-26.09.16-open-redirect-via-url-parameters | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| e621ng | >= 0, < 26.09.16 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | [email protected] |