CVE-2026-18737

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18737
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18737.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18737
Published
2026-08-03T20:40:28.334Z
Modified
2026-08-06T03:31:07.617429667Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Shlink Blind SQL Injection via tags/stats orderBy Parameter
Details

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18737.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/shlinkio/shlink

Affected ranges

Type
GIT
Repo
https://github.com/shlinkio/shlink
Events
Introduced
5b9a1e1978fa3f3a40b3296c51d1877c58e6ae8c
Last affected
c201760cccb84c61f70d16baca26e1e548eb1157
Database specific 
{
    "extracted_events": [
        {
            "introduced": "3.3.1"
        },
        {
            "last_affected": "5.1.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v3.*
v3.3.1
v3.3.2
v3.4.0
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.6.0
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18737.json"