e621ng EUVD-2026-84860

Exploitation requires that a victim open an attacker-supplied URL to a legitimate e621ng instance (before 26.09.16) containing reserved Rails url_for options as query parameters (host, protocol, and/or port), and then click a resulting pagination or navigation control (Previous/Next, numbered pages) whose href has been rewritten to the attacker-controlled origin. No authentication or special server configuration is needed (affects default request handling in PaginatorComponent and the comments/comment_votes/post_versions/post_votes controllers and search_trend views). The key limiting factor is user interaction: the initial page still loads from the legitimate site, so a click on the poisoned link is required - this is not an automatic redirect, reducing exploitation reliability.

This is a genuine but limited-severity issue. The CVSS 4.0 base is 5.3 (MEDIUM) with AV:N/AC:L/PR:N/UI:P - network-reachable, low-complexity, and unauthenticated, but requiring passive user interaction (the victim must click a poisoned pagination/navigation link). Impact is constrained to low integrity/confidentiality on both the vulnerable and subsequent systems (VC:L/VI:L/SC:L/SI:L, VA:N/SA:N), consistent with an open redirect (CWE-601) rather than code execution or data theft. No EPSS score, no CISA KEV listing, and no standalone weaponized exploit were provided, so real-world exploitation pressure is low; however, the vendor PR (#2518) ships a regression test (url_injection_spec.rb) that demonstrates the exact injection, which effectively serves as public proof-of-concept detail. Net: a real, patchable weakness worth fixing, but a moderate/phishing-enablement risk - not a drop-everything emergency. Note the mechanism is a poisoned-link (navigation controls point to attacker origin) rather than an immediate server-side redirect, which lowers reliability versus a classic 302 open redirect.

An attacker crafts a link to a legitimate e621ng page appending reserved URL-generation parameters (e.g. ?host=evil.example&protocol=ftp&port=1234) and distributes it via a forum post, message, or ad. When the victim opens the page it loads normally from the real site, but the rendered pagination and 'Previous/Next' navigation links now point to the attacker-controlled origin; clicking one sends the victim to the malicious domain for phishing or credential harvesting. The vendor's added test case (url_injection_spec.rb) confirms the ?host=/?protocol=/?port= injection path, functioning as a working reproduction.