Threat Intelligence Database

Shlink versions 5.0.0 through 5.1.5 are affected by a CSV formula injection vulnerability. This flaw allows unauthenticated remote attackers to inject malicious spreadsheet formulas into exported visit data by manipulating certain HTTP headers or request paths. When an administrator opens the exported CSV file in a spreadsheet software that evaluates formulas, these payloads can execute. The vulnerability has a medium severity rating and a CVSS score of 5.1. No official patch or remediation guidance is currently confirmed.

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information via the HTML title element returned in the short URL creation response.