CVE-2026-18738

Received Received - Intake

CSV Formula Injection in Shlink Short URL Exporter

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-18738

Affected Vendors & Products

Vendor	Product	Version / Range
shlink	shlink	From 5.0.0 (inc) to 5.1.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1236	The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

Executive Summary

Shlink versions 5.0.0 through 5.1.5 have a CSV formula injection vulnerability. Attackers can inject malicious spreadsheet formulas into exported visit data by manipulating User-Agent, Referer, or request path headers with characters like =, +, -, or @. When an administrator opens the exported CSV file in a spreadsheet application that evaluates formulas, the payload executes on their machine.

Detection Guidance

To detect this vulnerability, monitor HTTP request headers (User-Agent, Referer, path) for values starting with formula-triggering characters like =, +, -, or @. Inspect Shlink server logs for suspicious CSV export requests containing these patterns.

Impact Analysis

An unauthenticated attacker can craft a single request to embed harmful formulas like DDE or WEBSERVICE into CSV cells. If you export visit data and open it in a spreadsheet, the formulas may execute, potentially leading to unauthorized actions or data exposure on your system.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration if formulas execute malicious actions. For GDPR, it may violate principles of data protection and user rights. For HIPAA, it could compromise protected health information integrity and confidentiality.

Mitigation Strategies

Upgrade Shlink to version 5.1.6 or later which patches this issue. If immediate upgrade is not possible, implement input validation to block or sanitize header values starting with formula characters before processing.

Hi! I’m here to help you understand CVE-2026-18738. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70