CVE-2026-18738

MEDIUM 4.7

Shlink CSV Formula Injection via Visit Export CLI

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.

CWE	CWE-1236
Vendor	shlinkio
Product	shlink
Published	Aug 3, 2026

Stay Ahead of the Next One

Get instant alerts for shlinkio shlink

Be the first to know when new medium vulnerabilities affecting shlinkio shlink are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

shlinkio / Shlink

5.0.0 ≤ 5.1.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/theopaid/CSV-formula-injection-in-visit-exports-shlink- github.com: https://github.com/shlinkio/shlink vulncheck.com: https://www.vulncheck.com/advisories/shlink-csv-formula-injection-via-visit-export-cli

Credits

Theodosis Paidakis