CVE-2026-18738
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability. An unauthenticated attacker can send a single request to any short URL, supplying malicious values in User-Agent, Referer, or request path headers that begin with formula-triggering characters (=, +, -, @). When the exported visit data CSV is opened in a spreadsheet application, DDE or WEBSERVICE formulas are executed on the administrator's client machine.
Risk Assessment
The risk is remote code execution on the administrator's machine upon opening the CSV file, potentially leading to workstation compromise and data theft.
Recommendation
Upgrade Shlink to version 5.1.6 or later immediately. Consider using CSV sanitization tools for exported data.
Other vulnerabilities in Shlink
See all- CVE-2026-50887Critical
In version 5.0.1 of shlink, there is a Server-Side Request Forgery (SSRF) vulnerability in the automatic short URL title resolution component, allowing attackers to scan internal resources by supplying a crafted longUrl.
- CVE-2026-18737Medium
Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments via an unvalidated direction value in the orderBy parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flow unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets.
- CVE-2026-18736Medium
Shlink contains a server-side request forgery (SSRF) vulnerability that allows authenticated API key holders to force the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can use URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information.
Original NVD description (English source)
Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.