Executive brief
Shlink is a self-hosted URL shortener that can automatically fetch and display the title of linked web pages. When this feature is enabled, an authenticated user with any API key can trick the server into making requests to internal systems (including private networks and cloud metadata endpoints) and leak sensitive information through the page title returned in the response. This could expose internal service details and credentials stored in cloud metadata.
Technical details
This is a server-side request forgery (SSRF) vulnerability in Shlink's ShortUrlTitleResolutionHelper component. When title auto-resolution is enabled, the application fetches the target URL during short URL creation to extract the HTML title element, with no host-based restrictions or private IP filtering. The vulnerable code in module/Core/src/ShortUrl/Helper/ShortUrlTitleResolutionHelper.php allows any authenticated API key holder to supply arbitrary URLs and the server will follow up to 15 HTTP redirects without validating the destination. An attacker can supply URLs pointing to localhost, link-local addresses (169.254.169.254), or other private network ranges; public redirect chains bypassing URL-only validation are also effective. Extracted page titles are persisted and returned in the API response, enabling information exfiltration. This requires an authenticated API key (any role can create short URLs) and the AUTO_RESOLVE_TITLES feature to be explicitly enabled (off by default). No patch has been released as of the advisory date.
Affected products
- Shlink Shlink 2.6.0 through 5.1.5
Timeline
- 2026-08-03: disclosed