EUVD-2026-36785
GHSA-p85r-x2wj-mxqj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote unauthenticated SSRF via longUrl yields high confidentiality (metadata/internal data) but only low integrity (limited write side effects) and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.
AnalysisAI
Server-side request forgery in Shlink v5.0.1's automatic short URL title resolution allows remote unauthenticated attackers to probe internal network resources by submitting a crafted longUrl value. The flaw carries a CVSS 9.1 rating reflecting high confidentiality and integrity impact, though EPSS exploitation probability remains low at 0.15% and there is no public exploit identified at time of analysis beyond a referenced gist. Shlink is a self-hosted URL shortener, making this a meaningful pivot point for attackers targeting internal infrastructure behind the shortener host.
Technical ContextAI
Shlink is an open-source self-hosted URL shortener written in PHP that, by design, fetches the destination of submitted long URLs to automatically resolve and store the page title for each short link. This title-resolution feature performs server-side HTTP requests to attacker-controlled URLs, which is the classic precondition for CWE-918 Server-Side Request Forgery: user-supplied input is used as the target of an outbound request without sufficient validation of host, scheme, or address (RFC1918, loopback, link-local, cloud metadata endpoints such as 169.254.169.254). The CPE provided by NVD is the placeholder cpe:2.3:a:n/a:n/a:*, so authoritative product identification relies on the description, which explicitly names shlink v5.0.1 as the affected version.
RemediationAI
No vendor-released patch identified at time of analysis - neither the references nor the EUVD entry cite a fixed Shlink release, so operators should monitor the upstream shlinkio/shlink GitHub project for a post-5.0.1 release that addresses URL validation in the title-resolution component and upgrade as soon as one is published. As compensating controls, disable automatic short URL title resolution in Shlink's configuration if exposed (this removes the SSRF sink at the cost of losing auto-populated titles), egress-filter the Shlink container or host so it cannot reach RFC1918 ranges, loopback, link-local 169.254.0.0/16 (blocks cloud-metadata abuse but may break legitimate intranet shortening), and place Shlink behind authentication or an allow-list at the reverse proxy so only trusted users can submit longUrl values (trade-off: breaks public shortener use cases). Re-check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-50887 for an updated advisory link once vendor guidance appears.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today