CVE-2026-18737
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments via an unvalidated direction value in the orderBy parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flow unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets.
Risk Assessment
The risk includes leakage of sensitive data, including API keys and visitor records, potentially leading to confidentiality and integrity breaches.
Recommendation
Upgrade Shlink to a patched version immediately. Restrict API key permissions and use parameterized queries.
Other vulnerabilities in Shlink
See all- CVE-2026-50887Critical
In version 5.0.1 of shlink, there is a Server-Side Request Forgery (SSRF) vulnerability in the automatic short URL title resolution component, allowing attackers to scan internal resources by supplying a crafted longUrl.
- CVE-2026-18738Medium
Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability. An unauthenticated attacker can send a single request to any short URL, supplying malicious values in User-Agent, Referer, or request path headers that begin with formula-triggering characters (=, +, -, @). When the exported visit data CSV is opened in a spreadsheet application, DDE or WEBSERVICE formulas are executed on the administrator's client machine.
- CVE-2026-18736Medium
Shlink contains a server-side request forgery (SSRF) vulnerability that allows authenticated API key holders to force the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can use URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information.
Original NVD description (English source)
Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.