CVE-2026-95813
e621ng before 26.09.16 Open Redirect via URL Parameters
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 22, 2026
- Updated
- Sep 26, 2026
- Reserved
- Sep 22, 2026
Description
e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query parameters that are interpreted as URL generation options, causing pagination links to point to malicious domains while the initial page loads from the legitimate site.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected Products
| Product | Versions |
|---|---|
e621nge621ng |
|
References
- Pull Request #2518patchissue-tracking
- Patch Commitpatch
- e621ng 26.09.16 Release Notesrelease-notes
- PaginatorComponent#nav_params_for at 26.09.02technical-description
- https://github.com/e621ng/e621ngproduct
- VulnCheck Advisory: e621ng before 26.09.16 Open Redirect via URL Parametersthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.