Executive brief
Shlink is a self-hosted URL shortening service. A vulnerability in its CSV export feature allows attackers to inject spreadsheet formulas into visit data by crafting malicious User-Agent or Referer headers. When an administrator exports visits and opens the CSV file in a spreadsheet application, these formulas are executed automatically, potentially leading to information disclosure or command execution on the administrator's machine.
Technical details
This is a CSV formula injection vulnerability (CWE-1236) in the visit export functionality of Shlink versions 5.0.0 through 5.1.5. The vulnerable code in VisitsCommandUtils.php writes visitor-controlled fields (User-Agent, Referer, and visited URL) directly into CSV cells without neutralizing formula-triggering characters (=, +, -, @, tab, carriage return). An unauthenticated attacker can craft a request to any short URL with malicious headers containing DDE or WEBSERVICE formula payloads. When an administrator exports visits to CSV via CLI commands (short-url:visits, visit:orphan, visit:non-orphan, tag:visits, domain:visits) and opens the file in a spreadsheet application that evaluates formulas, the injected formulas are executed in the context of the administrator's machine. The fix is to apply the League\Csv\EscapeFormula formatter before writing rows to escape formula-triggering characters.
Affected products
- Shlink Shlink 5.0.0 through 5.1.5
Timeline
- 2026-08-03: disclosed