CVE-2026-18738mediumCWE-1236

CVE-2026-18738: medium-severity vulnerability in shlinkio Shlink

Shlink CSV Formula Injection via Visit Export CLI

Published · Updated

Follow this CVE+ Monitor Shlink

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.5%
Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
shlinkio · Shlink
Related CVEs — shlinkio Shlink

In the same product, most dangerous first.

CVE-2026-18737HIGHShlink Blind SQL Injection via tags/stats orderBy ParameterEPSS 0.4%CVE-2026-18736MEDIUMShlink Server-Side Request Forgery via Short URL Title Auto-ResolutionEPSS 0.3%