Skip to main content

Shlink CVE-2026-18737

| EUVDEUVD-2026-52434 HIGH
SQL Injection (CWE-89)
2026-08-03 VulnCheck GHSA-2jhc-j623-f52p
Information Disclosure Oracle SQLi Shlink
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

REST API endpoint is network-accessible requiring only an API key (PR:L, AV:N); read-only extraction with no confirmed integrity or availability impact (I:N, A:N, S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 03, 2026 - 21:07 vuln.today
CVE Published
Aug 03, 2026 - 20:40 cve.org
HIGH 7.1

DescriptionCVE.org

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.

AnalysisAI

Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated direction value of the orderBy query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain any valid Shlink API key
Delivery
Craft malicious SQL fragment as direction value in orderBy parameter
Exploit
Send HTTP GET request to /rest/v{n}/tags/stats endpoint
Execution
Unsanitized input injected into Doctrine QueryBuilder ORDER BY clause
Persist
Database executes attacker-controlled SQL subquery
Impact
Extract sensitive data via repeated time-based or boolean-oracle requests
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires possession of any valid Shlink API key - no administrative, owner-level, or elevated privileges are needed; any tenant's key suffices. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N accurately reflects the risk profile: network-accessible, low-complexity, authenticated (API key required, PR:L), with high confidentiality impact and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker holding any valid Shlink API key sends a crafted GET request to /rest/v{n}/tags/stats?orderBy=visits:SLEEP(5)-- or an equivalent boolean-oracle payload, causing the database to delay responses in proportion to injected logic. By iterating injected subqueries, the attacker enumerates hashed API key secrets, full destination URLs, visitor IP addresses, and geolocation records from the shared database across all tenants. …
Remediation No vendor-released patch version is confirmed from available data - operators should monitor the official Shlink GitHub repository (https://github.com/shlinkio/shlink) and the VulnCheck advisory (https://www.vulncheck.com/advisories/shlink-blind-sql-injection-via-tags-stats-orderby-parameter) for an updated release and apply it immediately upon availability. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Shlink deployments in use, audit API key distribution and access controls, disable unnecessary or unused API keys, and enable comprehensive logging of tag statistics endpoint access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Shlink

View all
CVE-2026-18736 MEDIUM
5.3 Aug 03

Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary H
CVE-2026-18738 MEDIUM
5.1 Aug 03

CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsh

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-18737 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy