EUVD-2026-52434
GHSA-2jhc-j623-f52p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any valid Shlink API key
-
DeliveryCraft malicious SQL fragment as direction value in orderBy parameter
-
ExploitSend HTTP GET request to /rest/v{n}/tags/stats endpoint
-
ExecutionUnsanitized input injected into Doctrine QueryBuilder ORDER BY clause
-
PersistDatabase executes attacker-controlled SQL subquery
-
ImpactExtract sensitive data via repeated time-based or boolean-oracle requests
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires possession of any valid Shlink API key - no administrative, owner-level, or elevated privileges are needed; any tenant's key suffices. The injection point is the |
| Impact | The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N accurately reflects the risk profile: network-accessible, low-complexity, authenticated (API key required, PR:L), with high confidentiality impact and no integrity or availability impact. The CVSS signals are internally consistent with the description - network vector aligns with the REST API exposure, and low-privilege matches the API key authentication model. A public proof-of-concept repository (theopaid on GitHub) exists, substantially lowering the exploitation skill threshold and elevating real-world urgency beyond what the raw score alone conveys. The vulnerability is not currently listed in CISA KEV, so mass in-the-wild exploitation is not confirmed at time of analysis; however, the combination of a public POC and a single-credential exploitation path means the window between publication and active abuse is likely short. The sole meaningful limiting factor is the requirement for a valid API key, which reduces but does not eliminate exposure - particularly in environments with broadly issued keys or shared tenant deployments. |
| Exploit ScenarioDerived | An attacker holding any valid Shlink API key sends a crafted GET request to /rest/v{n}/tags/stats?orderBy=visits:SLEEP(5)-- or an equivalent boolean-oracle payload, causing the database to delay responses in proportion to injected logic. By iterating injected subqueries, the attacker enumerates hashed API key secrets, full destination URLs, visitor IP addresses, and geolocation records from the shared database across all tenants. A public proof-of-concept on GitHub reduces the expertise required to near-zero for anyone already holding an API key. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated direction value of the orderBy query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
RemediationAI
No vendor-released patch version is confirmed from available data - operators should monitor the official Shlink GitHub repository (https://github.com/shlinkio/shlink) and the VulnCheck advisory (https://www.vulncheck.com/advisories/shlink-blind-sql-injection-via-tags-stats-orderby-parameter) for an updated release and apply it immediately upon availability. As an immediate compensating control, audit and revoke all API keys issued to untrusted or non-essential parties, since any valid API key is sufficient for exploitation. Consider blocking or rate-limiting access to the tag statistics endpoint (GET /rest/v{n}/tags/stats) at the reverse proxy or WAF layer to reduce automated exploitation throughput; note that this impacts legitimate tag analytics consumers. Deploy WAF rules targeting ORDER BY injection patterns such as time-delay functions (SLEEP, WAITFOR) and nested SELECT subqueries in sort parameters, accepting that sophisticated bypass techniques may circumvent signature-based detection. If the tag statistics endpoint is not operationally required, disabling it entirely at the application or proxy level eliminates the attack surface with no side effects on other Shlink functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Shlink (CPE: cpe:2.3:a:shlinkio:shlink:*:*:*:*:*:*:*:*) is an open-source PHP-based URL shortener using Doctrine ORM's QueryBuilder for database interaction. The root cause is CWE-89 (SQL Injection): ORDER BY clauses cannot leverage standard parameterized query bindings in the same way as WHERE predicates, and Shlink's tag statistics endpoint omits any allowlist validation or sanitization of the direction sort-direction value before concatenating it into the ORDER BY clause. This allows attackers to inject SQL subqueries - including time-delayed expressions (e.g., SLEEP), boolean conditionals, and error-generating constructs - that the database engine executes with the privileges of the application database user. Because Shlink operates as a multi-tenant URL shortening service, a single compromised or malicious API key can be used to enumerate data belonging to any tenant stored in the shared database.
Know when Shlink gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
REST API endpoint is network-accessible requiring only an API key (PR:L, AV:N); read-only extraction with no confirmed integrity or availability impact (I:N, A:N, S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.
Executive ViewAI
Shlink contains a critical data exposure vulnerability in its tag statistics API with publicly available exploit code, allowing any API key holder to extract sensitive business data including shortened URLs, visitor records, IP geolocation, and hashed API secrets across all tenant databases. This multi-tenant exposure creates immediate regulatory and business risk through potential data breach. With no vendor patch currently available, immediate remediation action is required.
Until vendor patch is available: (1) Restrict network access to the tag statistics REST endpoint via firewall or Web Application Firewall, limiting to internal-only addresses or disabling if not operationally required; (2) Rotate all API keys and enforce principle of least privilege with restricted scope; (3) Implement request-rate limiting and WAF rules to detect and block SQL injection attempts; (4) Enable database query audit logging and monitor for suspicious data extraction patterns; (5) Consider completely disabling the tag statistics API feature until patched if business operations permit.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Information disclosure in Shlink through 5.1.6 allows an attacker who already holds a role-restricted API key (author-on
Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary H
CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsh
Exploit-DB