id: CVE-2026-95813

info:
  name: "e621ng - Open Redirect via Pagination Host Parameter"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    e621ng before 26.09.16 passes untrusted request parameters straight into the Rails url_for helper in
    PaginatorComponent and controller navigation links. An unauthenticated attacker can supply host, protocol and
    port query parameters that Rails interprets as URL-generation options, so the pagination and navigation links
    rendered on listing pages (for example /posts) point at an attacker-controlled origin while the page itself
    still loads from the legitimate site. The template requests a listing page with an attacker host and confirms
    the vulnerability when that host is reflected into an absolute pagination link in the response body.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-95813&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=e621ng&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
    cve-id: CVE-2026-95813
    cwe-id: CWE-601
  metadata:
    verified: false
  tags: cve,cve2026,e621ng,redirect,unauth

variables:
  redir: "vedas{{rand_int(100000,999999)}}.example.com"

http:
  - method: GET
    path:
      - "{{BaseURL}}/posts?page=2&host={{redir}}&protocol=https"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "//{{redir}}/"
      - type: status
        status:
          - 200