Vulnerability Description
e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query parameters that are interpreted as URL generation options, causing pagination links to point to malicious domains while the initial page loads from the legitimate site.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/e621ng/e621ng
- https://github.com/e621ng/e621ng/blob/26.09.02/app/components/paginator_componen
- https://github.com/e621ng/e621ng/commit/e1a3930bf1750b02a23843ec88c33e2aa06e2a5e
- https://github.com/e621ng/e621ng/pull/2518
- https://github.com/e621ng/e621ng/releases/tag/26.09.16
- https://www.vulncheck.com/advisories/e621ng-before-26.09.16-open-redirect-via-ur
FAQ
What is CVE-2026-95813?
CVE-2026-95813 is a vulnerability with a CVSS score of 6.1 (MEDIUM). e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigat...
How severe is CVE-2026-95813?
CVE-2026-95813 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-95813?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.