CVE-2026-95813

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query parameters that are interpreted as URL generation options, causing pagination links to point to malicious domains while the initial page loads from the legitimate site.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/e621ng/e621ng
https://github.com/e621ng/e621ng/blob/26.09.02/app/components/paginator_component.rb
https://github.com/e621ng/e621ng/commit/e1a3930bf1750b02a23843ec88c33e2aa06e2a5e
https://github.com/e621ng/e621ng/pull/2518
https://github.com/e621ng/e621ng/releases/tag/26.09.16
https://www.vulncheck.com/advisories/e621ng-before-26.09.16-open-redirect-via-url-parameters

Configurations

No configuration.

History

22 Sep 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-22 21:17

Updated : 2026-09-26 01:17

NVD link : CVE-2026-95813

Mitre link : CVE-2026-95813

CVE.ORG link : CVE-2026-95813

JSON object : View

Products Affected

No product.

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-95813", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-95813", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-26T00:11:16.295027Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/e621ng/e621ng", "vendor": "e621ng", "product": "e621ng", "versions": [{"status": "affected", "version": "0", "lessThan": "26.09.16", "versionType": "custom"}, {"status": "unaffected", "version": "26.09.16", "versionType": "custom"}], "packageURL": "pkg:github/e621ng/e621ng", "collectionURL": "https://github.com/e621ng/e621ng", "defaultStatus": "unaffected"}]}], "published": "2026-09-22T21:17:34.217", "references": [{"url": "https://github.com/e621ng/e621ng", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/e621ng/e621ng/blob/26.09.02/app/components/paginator_component.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/e621ng/e621ng/commit/e1a3930bf1750b02a23843ec88c33e2aa06e2a5e", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/e621ng/e621ng/pull/2518", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/e621ng/e621ng/releases/tag/26.09.16", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/e621ng-before-26.09.16-open-redirect-via-url-parameters", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query parameters that are interpreted as URL generation options, causing pagination links to point to malicious domains while the initial page loads from the legitimate site."}], "lastModified": "2026-09-26T01:17:02.930", "sourceIdentifier": "disclosure@vulncheck.com"}