CVE-2026-18738

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-18738

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18738.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-18738

Published

2026-08-03T20:53:57.661Z

Modified

2026-08-05T03:47:17.161113160Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Shlink CSV Formula Injection via Visit Export CLI

Details

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.

Database specific

{
    "cwe_ids": [
        "CWE-1236"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18738.json"
}

References

Affected packages

Git / github.com/shlinkio/shlink

Affected ranges

Type

GIT

Repo

https://github.com/shlinkio/shlink

Events

Introduced

5b4e0b1d84d810684b96dc02a0b1137b8a6d687f

Fixed

c201760cccb84c61f70d16baca26e1e548eb1157

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "last_affected": "5.1.5"
        },
        {
            "fixed": "5.1.5"
        }
    ]
}

Affected versions

v5.*

v5.0.0

v5.0.1

v5.0.2

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v5.1.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18738.json"