CVE-2026-95813: e621ng before 26.09.16 Open Redirect via URL Parameters
e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails urlfor in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query parameters that are interpreted as URL generation options, causing pagination links to point to malicious domains while the initial page loads from the legitimate site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
e621ngto a version that resolves this vulnerability.Fixed in 26.09.16
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances of e621ng running a version earlier than 26.09.16 are exposed when users can be induced to visit a crafted URL. The attacker does not need privileges, but a user must interact with affected pagination or navigation controls.
What does an attacker need to exploit it?
An attacker needs to supply crafted host, protocol, or port query parameters in a URL to an affected e621ng instance. Those parameters can cause generated pagination and navigation links to target an attacker-controlled origin even though the initial page is served by the legitimate site.
Is the initial page itself redirected?
No. The initial page loads from the legitimate site; the attacker-controlled destination is introduced through pagination and navigation links generated on that page.
What is the available remediation?
Upgrade e621ng to version 26.09.16 or later. The affected behavior applies to versions before 26.09.16.