CVE-2026-18738

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/shlinkio/shlink
https://github.com/theopaid/CSV-formula-injection-in-visit-exports-shlink-
https://www.vulncheck.com/advisories/shlink-csv-formula-injection-via-visit-export-cli

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Shlink 5.0.0 a 5.1.5 contienen una vulnerabilidad de inyección de fórmulas CSV que permite a atacantes remotos no autenticados insertar fórmulas de hoja de cálculo en los datos de visita exportados al proporcionar valores maliciosos en los encabezados User-Agent, Referer o de la ruta de solicitud que comienzan con caracteres que activan fórmulas, como =, +, - o @. Los atacantes pueden elaborar una única solicitud no autenticada contra cualquier URL corta para incrustar cargas útiles de fórmulas DDE o WEBSERVICE en celdas CSV, que luego se ejecutan en la máquina cliente de un administrador cuando el archivo CSV exportado se abre en una aplicación de hoja de cálculo que evalúa fórmulas.

Information

Published : 2026-08-03 21:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-18738

Mitre link : CVE-2026-18738

CVE.ORG link : CVE-2026-18738

JSON object : View

Products Affected

No product.

CWE

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

{"id": "CVE-2026-18738", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18738", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T14:28:31.781240Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "shlinkio", "product": "Shlink", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "git", "lessThanOrEqual": "5.1.5"}], "defaultStatus": "affected"}]}], "published": "2026-08-03T21:16:38.377", "references": [{"url": "https://github.com/shlinkio/shlink", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/theopaid/CSV-formula-injection-in-visit-exports-shlink-", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/shlink-csv-formula-injection-via-visit-export-cli", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-1236"}]}], "descriptions": [{"lang": "en", "value": "Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas."}, {"lang": "es", "value": "Las versiones de Shlink 5.0.0 a 5.1.5 contienen una vulnerabilidad de inyecci\u00f3n de f\u00f3rmulas CSV que permite a atacantes remotos no autenticados insertar f\u00f3rmulas de hoja de c\u00e1lculo en los datos de visita exportados al proporcionar valores maliciosos en los encabezados User-Agent, Referer o de la ruta de solicitud que comienzan con caracteres que activan f\u00f3rmulas, como =, +, - o @. Los atacantes pueden elaborar una \u00fanica solicitud no autenticada contra cualquier URL corta para incrustar cargas \u00fatiles de f\u00f3rmulas DDE o WEBSERVICE en celdas CSV, que luego se ejecutan en la m\u00e1quina cliente de un administrador cuando el archivo CSV exportado se abre en una aplicaci\u00f3n de hoja de c\u00e1lculo que eval\u00faa f\u00f3rmulas."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}