CVE-2026-18737

Name of the Vulnerable Software and Affected Versions Shlink (affected versions not specified)

Description An authenticated API key holder can perform a blind SQL injection by providing an unvalidated value in the orderBy query parameter of the tag statistics endpoint. This occurs because the input flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, allowing the injection of arbitrary SQL fragments. This can lead to the extraction of sensitive data from any tenant, including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets, using time-based, boolean-oracle, or error-based techniques.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.