CVE-2026-18738 describes a CSV formula injection vulnerability in Shlink versions 5.0.0 through 5.1.5. Attackers can supply malicious values starting with formula-triggering characters (=, +, -, @) in User-Agent, Referer, or request path headers. These values are embedded into exported CSV visit data without proper neutralization, enabling execution of spreadsheet formulas such as DDE or WEBSERVICE when the CSV is opened by an administrator. The vulnerability requires no authentication and has a medium CVSS 4.0 base score of 5.1. No vendor advisory or patch information is available at this time.

An unauthenticated remote attacker can inject malicious spreadsheet formulas into CSV exports of visit data. When an administrator opens the exported CSV file in a spreadsheet application that evaluates formulas, these formulas may execute, potentially leading to code execution or data exfiltration on the administrator's machine. The vulnerability affects the integrity and safety of exported data handling but requires user interaction to open the malicious CSV file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when opening CSV exports from Shlink, especially those containing untrusted input. Consider sanitizing or disabling formula evaluation in spreadsheet applications as a temporary mitigation.