Shlinkio
Monthly
Information disclosure in Shlink through 5.1.6 allows an attacker who already holds a role-restricted API key (author-only or domain-only) to read visit analytics - referrer, user agent, geolocation and full short-URL objects - for links outside that key's authorization boundary. The mercure-info endpoint mints a Mercure subscription JWT without applying the API key's role restrictions, so the scoped credential can subscribe to every topic rather than only its own. Exploitation is authenticated (CVSS vector PR:L, matching the independently assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and additionally requires Mercure real-time updates to be configured and enabled on the target deployment; impact is confidentiality-only with no integrity or availability effect, and no public exploit identified at time of analysis.
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated `direction` value of the `orderBy` query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsheet formulas into visit export data by supplying formula-triggering values in User-Agent, Referer, or request path headers targeting any short URL. The payload lies dormant in Shlink's visit log until an administrator exports the data as CSV and opens it in a spreadsheet application (Excel, LibreOffice Calc) with formula evaluation enabled, at which point the formula executes in the context of the administrator's machine. A public proof-of-concept repository exists; no CISA KEV listing is present, and no public exploit exploitation in the wild has been confirmed at time of analysis.
Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary HTTP GET requests to internal network targets, including cloud metadata endpoints such as 169.254.169.254, by submitting crafted URLs during short URL creation when title auto-resolution is enabled. The server follows HTTP redirects from attacker-controlled public hosts to otherwise-inaccessible internal addresses, then returns fetched content via the HTML title element in the API response, enabling exfiltration of internal service data. No active exploitation is confirmed in CISA KEV, but a public proof-of-concept advisory repository exists, and the attack requires only a valid API key with title auto-resolution active.
Information disclosure in Shlink through 5.1.6 allows an attacker who already holds a role-restricted API key (author-only or domain-only) to read visit analytics - referrer, user agent, geolocation and full short-URL objects - for links outside that key's authorization boundary. The mercure-info endpoint mints a Mercure subscription JWT without applying the API key's role restrictions, so the scoped credential can subscribe to every topic rather than only its own. Exploitation is authenticated (CVSS vector PR:L, matching the independently assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and additionally requires Mercure real-time updates to be configured and enabled on the target deployment; impact is confidentiality-only with no integrity or availability effect, and no public exploit identified at time of analysis.
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated `direction` value of the `orderBy` query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsheet formulas into visit export data by supplying formula-triggering values in User-Agent, Referer, or request path headers targeting any short URL. The payload lies dormant in Shlink's visit log until an administrator exports the data as CSV and opens it in a spreadsheet application (Excel, LibreOffice Calc) with formula evaluation enabled, at which point the formula executes in the context of the administrator's machine. A public proof-of-concept repository exists; no CISA KEV listing is present, and no public exploit exploitation in the wild has been confirmed at time of analysis.
Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary HTTP GET requests to internal network targets, including cloud metadata endpoints such as 169.254.169.254, by submitting crafted URLs during short URL creation when title auto-resolution is enabled. The server follows HTTP redirects from attacker-controlled public hosts to otherwise-inaccessible internal addresses, then returns fetched content via the HTML title element in the API response, enabling exfiltration of internal service data. No active exploitation is confirmed in CISA KEV, but a public proof-of-concept advisory repository exists, and the attack requires only a valid API key with title auto-resolution active.