Vulnerability · Published Sep 22, 2026 · Assigned by VulnCheck

CVE-2026-95813e621ng before 26.09.16 Open Redirect via URL Parameters

Medium 6.1

In plain English

A medium-severity open redirect in e621ng from e621ng. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 72.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query parameters that are interpreted as URL generation options, causing pagination links to point to malicious domains while the initial page loads from the legitimate site.

Affected products (as reported)

Vendor	Product	Versions
e621ng	e621ng	0 – before 26.09.16

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Pull Request #2518 patch, issue-tracking
Patch Commit patch
e621ng 26.09.16 Release Notes release-notes
PaginatorComponent#nav_params_for at 26.09.02 technical-description
https://github.com/e621ng/e621ng product
VulnCheck Advisory: e621ng before 26.09.16 Open Redirect via URL Parameters third-party-advisory