CVE-2026-50887 is a critical SSRF vulnerability in shlink v5.0.1's automatic short URL title resolution feature. An attacker can exploit this by providing a specially crafted longUrl, causing the server to make unauthorized requests to internal resources. This can lead to disclosure of sensitive information and compromise of system integrity. The vulnerability is identified as CWE-918 and has a CVSS v3.1 base score of 9.1, indicating critical impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows an unauthenticated attacker to perform server-side request forgery, enabling scanning and potential information disclosure of internal network resources. The confidentiality and integrity of internal systems may be compromised. Availability impact is not indicated. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, avoid exposing the vulnerable feature or restrict access to trusted users if possible.