Threats affecting pkg:github/shlinkio/shlink

Shlink versions up to 5.1.6 have an authorization flaw where API key role restrictions are not properly enforced when issuing Mercure subscription tokens. This allows restricted API keys, such as author-only or domain-only keys, to subscribe to all topics and access visit data beyond their intended scope. The exposed data includes referrer, user agent, geolocation, and full short URL objects for URLs outside the authorized boundary.

Shlink versions 5.0.0 through 5.1.5 have a CSV formula injection vulnerability that allows unauthenticated attackers to inject malicious spreadsheet formulas into exported visit data. This occurs when attackers supply values starting with formula-triggering characters in HTTP headers or request paths. When an administrator opens the exported CSV file in a spreadsheet software that evaluates formulas, these malicious formulas can execute.

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.

Shlink version 2.6.0 contains a server-side request forgery (SSRF) vulnerability that allows authenticated API key holders to make the server perform arbitrary HTTP GET requests. This occurs when a crafted long URL is supplied during short URL creation with title auto-resolution enabled. The vulnerability can be exploited to access internal network resources, including cloud metadata endpoints, by leveraging redirects from public hosts. The vulnerability has a medium severity with a CVSS score of 5.3.