CVE-2026-18738

Name of the Vulnerable Software and Affected Versions Shlink versions 5.0.0 through 5.1.5

Description An issue exists where unauthenticated remote attackers can inject spreadsheet formulas into exported visit data. By sending a request to any short URL with malicious values in the User-Agent, Referer, or request path headers starting with characters like =, +, -, or @, attackers can embed DDE (Dynamic Data Exchange) or WEBSERVICE formula payloads. These payloads are executed on an administrator's machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.