Skip to main content

Shlink EUVDEUVD-2026-52439

| CVE-2026-18738 MEDIUM
Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
2026-08-03 VulnCheck GHSA-ghrv-q878-w45x
Code Injection Shlink
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

No auth required to inject; scope changes to administrator's spreadsheet client, yielding low confidentiality and integrity impact on the subsequent system.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 03, 2026 - 21:39 vuln.today

DescriptionCVE.org

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.

AnalysisAI

CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsheet formulas into visit export data by supplying formula-triggering values in User-Agent, Referer, or request path headers targeting any short URL. The payload lies dormant in Shlink's visit log until an administrator exports the data as CSV and opens it in a spreadsheet application (Excel, LibreOffice Calc) with formula evaluation enabled, at which point the formula executes in the context of the administrator's machine. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send crafted HTTP request to any short URL
Delivery
User-Agent/Referer stores formula payload in visit log
Exploit
Administrator exports visit data as CSV
Execution
Administrator opens CSV in spreadsheet application
Persist
Spreadsheet evaluates DDE/WEBSERVICE formula
Impact
Arbitrary command executes or data exfiltrated on admin client
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker requires only network access to any short URL hosted on the vulnerable Shlink instance - no authentication, no account, and no special configuration is required to plant the payload. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:N/UI:A) accurately captures the key risk qualifier: active user interaction is required - an administrator must both export and open the malicious CSV. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a single HTTP GET request to any publicly accessible Shlink short URL with a User-Agent header beginning with a DDE payload such as =DDE('cmd','/c powershell -enc <base64>','') - no account or prior knowledge beyond the Shlink instance's hostname is required. The malicious value is stored in Shlink's visit database. …
Remediation No vendor-released patch version has been independently confirmed from the available intelligence at time of analysis; the VulnCheck advisory at https://www.vulncheck.com/advisories/shlink-csv-formula-injection-via-visit-export-cli and the researcher's proof-of-concept at https://github.com/theopaid/CSV-formula-injection-in-visit-exports-shlink- should be monitored for a fixed release announcement. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Shlink

View all
CVE-2026-18737 HIGH
7.1 Aug 03

Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from th
CVE-2026-18736 MEDIUM
5.3 Aug 03

Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary H

Same weakness CWE-1236 – Improper Neutralization of Formula Elements in a CSV File

View all
CVE-2019-14749 HIGH POC
8.8
CVE-2020-36962 CRITICAL POC
9.8
CVE-2023-46401 CRITICAL POC
9.8
CVE-2025-56267 CRITICAL POC
9.8
CVE-2021-47901 CRITICAL POC
9.8
CVE-2020-36941 CRITICAL POC
9.8
CVE-2022-3574 CRITICAL POC
9.8
CVE-2022-3463 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

EUVD-2026-52439 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy