EUVD-2026-36785
GHSA-p85r-x2wj-mxqj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote unauthenticated SSRF via longUrl yields high confidentiality (metadata/internal data) but only low integrity (limited write side effects) and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.
AnalysisAI
Server-side request forgery in Shlink v5.0.1's automatic short URL title resolution allows remote unauthenticated attackers to probe internal network resources by submitting a crafted longUrl value. The flaw carries a CVSS 9.1 rating reflecting high confidentiality and integrity impact, though EPSS exploitation probability remains low at 0.15% and there is no public exploit identified at time of analysis beyond a referenced gist. Shlink is a self-hosted URL shortener, making this a meaningful pivot point for attackers targeting internal infrastructure behind the shortener host.
Technical ContextAI
Shlink is an open-source self-hosted URL shortener written in PHP that, by design, fetches the destination of submitted long URLs to automatically resolve and store the page title for each short link. This title-resolution feature performs server-side HTTP requests to attacker-controlled URLs, which is the classic precondition for CWE-918 Server-Side Request Forgery: user-supplied input is used as the target of an outbound request without sufficient validation of host, scheme, or address (RFC1918, loopback, link-local, cloud metadata endpoints such as 169.254.169.254). The CPE provided by NVD is the placeholder cpe:2.3:a:n/a:n/a:*, so authoritative product identification relies on the description, which explicitly names shlink v5.0.1 as the affected version.
RemediationAI
No vendor-released patch identified at time of analysis - neither the references nor the EUVD entry cite a fixed Shlink release, so operators should monitor the upstream shlinkio/shlink GitHub project for a post-5.0.1 release that addresses URL validation in the title-resolution component and upgrade as soon as one is published. As compensating controls, disable automatic short URL title resolution in Shlink's configuration if exposed (this removes the SSRF sink at the cost of losing auto-populated titles), egress-filter the Shlink container or host so it cannot reach RFC1918 ranges, loopback, link-local 169.254.0.0/16 (blocks cloud-metadata abuse but may break legitimate intranet shortening), and place Shlink behind authentication or an allow-list at the reverse proxy so only trusted users can submit longUrl values (trade-off: breaks public shortener use cases). Re-check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-50887 for an updated advisory link once vendor guidance appears.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today