CVE-2026-18736

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information via the HTML title element returned in the short URL creation response.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/shlinkio/shlink
https://github.com/theopaid/Server-side-request-forgery-through-short-URL-title-resolution-shlink-
https://www.vulncheck.com/advisories/shlink-server-side-request-forgery-via-short-url-title-auto-resolution
https://github.com/theopaid/Server-side-request-forgery-through-short-URL-title-resolution-shlink-

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Shlink contiene una vulnerabilidad de falsificación de petición del lado del servidor que permite a los titulares de claves API autenticados hacer que el servidor emita peticiones HTTP GET arbitrarias al proporcionar una URL larga manipulada durante la creación de URL cortas con la resolución automática de títulos habilitada. Los atacantes pueden enviar URLs que apunten a hosts públicos que redirijan a objetivos internos, incluyendo direcciones de bucle invertido, rangos link-local y puntos finales de metadatos en la nube como 169.254.169.254, para exfiltrar información de servicios internos a través del elemento de título HTML devuelto en la respuesta de creación de URL corta.

Information

Published : 2026-08-03 21:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-18736

Mitre link : CVE-2026-18736

CVE.ORG link : CVE-2026-18736

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-18736", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18736", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T13:44:56.395426Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "shlinkio", "product": "Shlink", "versions": [{"status": "affected", "version": "2.6.0", "versionType": "git", "lessThanOrEqual": "5.1.5"}], "defaultStatus": "affected"}]}], "published": "2026-08-03T21:16:38.093", "references": [{"url": "https://github.com/shlinkio/shlink", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/theopaid/Server-side-request-forgery-through-short-URL-title-resolution-shlink-", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/shlink-server-side-request-forgery-via-short-url-title-auto-resolution", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/theopaid/Server-side-request-forgery-through-short-URL-title-resolution-shlink-", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information via the HTML title element returned in the short URL creation response."}, {"lang": "es", "value": "Shlink contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor que permite a los titulares de claves API autenticados hacer que el servidor emita peticiones HTTP GET arbitrarias al proporcionar una URL larga manipulada durante la creaci\u00f3n de URL cortas con la resoluci\u00f3n autom\u00e1tica de t\u00edtulos habilitada. Los atacantes pueden enviar URLs que apunten a hosts p\u00fablicos que redirijan a objetivos internos, incluyendo direcciones de bucle invertido, rangos link-local y puntos finales de metadatos en la nube como 169.254.169.254, para exfiltrar informaci\u00f3n de servicios internos a trav\u00e9s del elemento de t\u00edtulo HTML devuelto en la respuesta de creaci\u00f3n de URL corta."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}