CVE-2026-95813

Name of the Vulnerable Software and Affected Versions e621ng versions prior to 26.09.16

Description Untrusted request parameters are passed directly to the Rails url for function within the PaginatorComponent and controller navigation links. This allows attackers to manipulate pagination and navigation controls by supplying host, protocol, and port query parameters. These parameters are interpreted as URL generation options, which can redirect users to malicious domains even when the initial page is loaded from the legitimate site.

Recommendations Update e621ng to version 26.09.16 or later.