CVE-2026-18738 describes a CSV formula injection vulnerability in Shlink versions 5.0.0 through 5.1.5. Unauthenticated remote attackers can inject spreadsheet formulas into exported CSV visit data by including malicious values beginning with characters such as '=', '+', '-', or '@' in User-Agent, Referer, or request path headers. These formulas can include DDE or WEBSERVICE payloads that execute on the client side when the CSV is opened in a spreadsheet application that processes formulas.

The vulnerability allows unauthenticated attackers to embed potentially harmful spreadsheet formulas into CSV exports, which can lead to code execution or data exfiltration on the administrator's machine when the CSV file is opened. This poses a risk to the confidentiality and integrity of the administrator's environment. However, exploitation requires the administrator to open the malicious CSV file in a vulnerable spreadsheet application and enable formula evaluation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid opening CSV exports from untrusted sources in spreadsheet applications that automatically evaluate formulas or should sanitize CSV data before opening.