CVE-2026-92760

In version 5.0.1 of shlink, there is a Server-Side Request Forgery (SSRF) vulnerability in the automatic short URL title resolution component, allowing attackers to scan internal resources by supplying a crafted longUrl.

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability. An unauthenticated attacker can send a single request to any short URL, supplying malicious values in User-Agent, Referer, or request path headers that begin with formula-triggering characters (=, +, -, @). When the exported visit data CSV is opened in a spreadsheet application, DDE or WEBSERVICE formulas are executed on the administrator's client machine.

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments via an unvalidated direction value in the orderBy parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flow unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets.

Shlink contains a server-side request forgery (SSRF) vulnerability that allows authenticated API key holders to force the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can use URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information.