CVE-2026-95813: e621ng CSRF Vulnerability via URL Redirect

CVE-2026-95813 Overview

CVE-2026-95813 is an open redirect vulnerability [CWE-601] affecting e621ng versions before 26.09.16. The application passes untrusted request parameters directly to the Rails url_for helper inside PaginatorComponent and controller navigation links. Attackers can supply host, protocol, and port query parameters that Rails interprets as URL generation options. As a result, pagination and navigation controls render links pointing to attacker-controlled origins while the initial page still loads from the legitimate site. This behavior enables phishing and credential-harvesting scenarios against users who trust the source domain.

Critical Impact
Attackers can rewrite pagination and navigation links to attacker-controlled domains, enabling phishing attacks that abuse the trust of the legitimate e621ng site.

Affected Products

e621ng versions prior to 26.09.16
app/components/paginator_component.rb component
Controller navigation links using url_for with unsanitized request parameters

Discovery Timeline

2026-09-22 - CVE CVE-2026-95813 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95813

Vulnerability Analysis

The vulnerability arises from unsafe use of Rails' url_for helper. When url_for receives a hash containing keys such as host, protocol, or port, it treats them as URL generation options rather than query parameters. The e621ngPaginatorComponent merged the raw request parameters into the hash passed to url_for. An attacker can append ?host=evil.example.com to a legitimate URL and cause the generated pagination links to point at evil.example.com while the current page continues to render from the trusted origin. The same pattern affected controller-generated navigation links such as those in comment_votes_controller.rb.

Root Cause

The root cause is direct forwarding of user-controlled parameters into a URL builder that supports host and protocol overrides. The original code called params.except(:id).merge(page: page).permit! and passed the result to url_for, allowing any attacker-supplied key to influence URL generation.

Attack Vector

Exploitation requires only a crafted link. The attacker sends a victim a URL to the legitimate site with host, protocol, or port query parameters. When the victim loads the page and clicks a pagination or navigation link, the browser navigates to the attacker's domain. User interaction is required, but no authentication is needed.

ruby

# Vulnerable code (before patch) in app/components/paginator_component.rb
def nav_params_for(page)
  query_params = params.except(:id).merge(page: page).permit!
  url_for(query_params)
end

# Fixed code (after patch)
def nav_params_for(page)
  url_for(params: request.query_parameters.merge("page" => page))
end
# Source: https://github.com/e621ng/e621ng/commit/e1a3930bf1750b02a23843ec88c33e2aa06e2a5e

The fix nests attacker-controllable values under the params: key so Rails treats them strictly as query parameters, preventing host and protocol injection.

Detection Methods for CVE-2026-95813

Indicators of Compromise

Inbound HTTP requests containing host=, protocol=, or port= query parameters on paginated endpoints.
Referrer logs showing users arriving from external sites with crafted parameters targeting pagination routes.
Rendered HTML pages containing pagination <a href> attributes whose hostnames differ from the application's canonical domain.

Detection Strategies

Inspect web server and reverse proxy access logs for requests containing host, protocol, subdomain, or port parameters on e621ng routes.
Add application-layer logging to record when url_for produces a link whose host does not match the configured application host.
Scan HTML responses in staging or synthetic monitors for pagination anchors that reference unexpected external domains.

Monitoring Recommendations

Alert on spikes in 3xx or outbound-referrer traffic originating from paginated views.
Monitor for user reports of unexpected domain transitions after clicking navigation controls on the site.
Track HTTP requests with query string keys that collide with Rails routing options across all internet-facing Rails applications.

How to Mitigate CVE-2026-95813

Immediate Actions Required

Upgrade e621ng to release 26.09.16 or later, which contains the fix from pull request #2518.
Audit all custom controllers and view components for direct use of url_for(params) patterns and refactor them to nest user input under the params: key.
Review recent access logs for exploitation attempts using host, protocol, or port parameters.

Patch Information

The fix is included in GitHub Release 26.09.16 and implemented in commit e1a3930 via Pull Request #2518. Additional context is available in the VulnCheck Advisory for e621ng.

Workarounds

Configure the reverse proxy or web application firewall to strip host, protocol, subdomain, and port query parameters from inbound requests.
Enforce a strict default_url_options host in the Rails environment configuration so generated URLs anchor to the canonical hostname.
Add a before_action filter that removes URL-generation option keys from params before controller actions execute.

bash

# Example nginx rule to strip dangerous query parameters
if ($args ~* "(^|&)(host|protocol|port|subdomain)=") {
    return 400;
}