CVE-2026-95813: falha de média gravidade em e621ng
e621ng before 26.09.16 Open Redirect via URL Parameters
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query parameters that are interpreted as URL generation options, causing pagination links to point to malicious domains while the initial page loads from the legitimate site.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
e621ng · e621ngReferências
https://github.com/e621ng/e621nghttps://github.com/e621ng/e621ng/blob/26.09.02/app/components/paginator_component.rbhttps://github.com/e621ng/e621ng/commit/e1a3930bf1750b02a23843ec88c33e2aa06e2a5ehttps://github.com/e621ng/e621ng/pull/2518https://github.com/e621ng/e621ng/releases/tag/26.09.16https://www.vulncheck.com/advisories/e621ng-before-26.09.16-open-redirect-via-url-parameters