Shlink EUVD-2026-52439

The attacker requires only network access to any short URL hosted on the vulnerable Shlink instance - no authentication, no account, and no special configuration is required to plant the payload. Exploitation of the planted payload is gated on two administrator actions: (1) the administrator must use the visit export feature to generate a CSV file, and (2) the administrator must open that CSV in a spreadsheet application (Excel, LibreOffice Calc, Google Sheets if imported) with formula evaluation or DDE connections enabled. DDE execution in Excel is blocked by default in Microsoft 365 versions since 2017 updates and requires the user to click through a security warning; older or unpatched Excel installations and LibreOffice with macro security set to low are more directly vulnerable. Exploitation is limited to Shlink versions 5.0.0-5.1.5 and does not affect instances where CSV export is restricted or disabled.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:N/UI:A) accurately captures the key risk qualifier: active user interaction is required - an administrator must both export and open the malicious CSV. This substantially limits opportunistic mass exploitation. EPSS data is not present in the supplied intelligence, so probabilistic exploitation likelihood cannot be quantified from this source. The product is not listed in CISA KEV, indicating no confirmed widespread active exploitation. A proof-of-concept repository exists, which lowers the skill bar for targeted attacks against Shlink administrators. Real-world risk is moderate for deployments where administrators routinely export visit analytics to spreadsheets with DDE or external data connections enabled - a common workflow in analytics-driven operations. The attack requires no authentication to plant the payload, but the two-step delivery (data injection then administrator action) makes mass automated exploitation unlikely. The biggest realistic risk is targeted social engineering or persistent poisoning of visit logs to eventually be opened by an admin.

An attacker sends a single HTTP GET request to any publicly accessible Shlink short URL with a User-Agent header beginning with a DDE payload such as =DDE('cmd','/c powershell -enc <base64>','') - no account or prior knowledge beyond the Shlink instance's hostname is required. The malicious value is stored in Shlink's visit database. When the administrator later exports visit analytics as CSV and opens the file in Microsoft Excel with DDE enabled, the formula executes silently, potentially running arbitrary commands or exfiltrating data to an attacker-controlled server. A public proof-of-concept repository demonstrates this injection path.