e621ng versions prior to 26.09.16 allow an attacker to supply host, protocol, and port query parameters that are treated as options by Rails url_for. This causes pagination and navigation links to point to attacker‑controlled destinations while the initial page is served from the legitimate site. The effect is an open redirect that can be used for phishing or further malicious activity. The weakness is a CWE‑601 URL Manipulation flaw.

The affected product is e621ng, any installation running a version older than 26.09.16. No other vendors or products are listed.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the exploit path is straightforward: a client visits a crafted URL; no authentication or additional conditions are required, making the attack likely through social engineering or malicious links.