CVE-2026-18738

Shlink CSV Formula Injection via Visit Export CLI

State: Published
Severity: 5.1 Medium
Published: Aug 3, 2026
Updated: Aug 4, 2026
Reserved: Aug 3, 2026

Description

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-1236 Improper Neutralization of Formula Elements in a CSV File

Affected Products

Product	Versions
Shlinkshlinkio	5.0.0 through 5.1.5Affected

References

GitHub Security Advisoryvendor-advisory
Product Repositoryproduct
https://www.vulncheck.com/advisories/shlink-csv-formula-injection-via-visit-export-clithird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.