Executive brief
Shlink is a self-hosted URL shortener that allows users to create, manage, and track shortened links. An authenticated attacker with any valid API key can extract sensitive data from the entire database through SQL injection in the tag statistics endpoint, including visitor records, long URLs, IP addresses, geolocation data, and hashed API key secrets belonging to other users and tenants.
Technical details
This is a blind SQL injection vulnerability (CWE-89) in the tag statistics endpoint (`GET /rest/v{n}/tags/stats`). The orderBy query parameter accepts a field-direction format, where the field is validated against an allowlist but the direction value is not sanitized. The unvalidated direction string is concatenated directly into a Doctrine QueryBuilder ORDER BY clause that executes as a native SQL query. An attacker with any valid API key (regardless of role restrictions) can inject SQL subqueries to perform time-based, boolean-oracle, and error-based data extraction. The vulnerability affects versions 3.3.1 through at least 5.1.5 with no patch available. The fix requires validating the direction parameter against allowed values (ASC/DESC) before query execution, similar to the validation applied in the short URLs endpoint.
Affected products
- Shlink Shlink 3.3.1 through 5.1.5
Timeline
- 2026-08-03: disclosed: CVE-2026-18737 published on NVD