Is CVE-2026-18738 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18738 being exploited in the wild.

How severe is CVE-2026-18738?

Medium severity, with a CVSS score of 4.7, published 3 August 2026.

Is there a fix for CVE-2026-18738?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18738 attacked?

It is attacked over the network.

Am I affected by CVE-2026-18738?

Check whether you run Shlink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18738: Shlink CSV formula injection in visit exports

CVE-2026-18738 · Severity: medium · CVSS 4.7 · Published 2026-08-03

Shlink is a self-hosted URL shortening service. A vulnerability in its CSV export feature allows attackers to inject spreadsheet formulas into visit data by crafting malicious User-Agent or Referer headers. When an administrator exports visits and opens the CSV file in a spreadsheet application, these formulas are executed automatically, potentially leading to information disclosure or command execution on the administrator's machine.

Technologies: Shlink. Vendors: Shlink.

Quick answers

Is CVE-2026-18738 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18738 being exploited in the wild.
How severe is CVE-2026-18738?: Medium severity, with a CVSS score of 4.7, published 3 August 2026.
Which products and versions are affected?: Shlink 5.0.0 through 5.1.5.
Is there a fix for CVE-2026-18738?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18738 attacked?: It is attacked over the network.
Am I affected by CVE-2026-18738?: Check whether you run Shlink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a CSV formula injection vulnerability (CWE-1236) in the visit export functionality of Shlink versions 5.0.0 through 5.1.5. The vulnerable code in VisitsCommandUtils.php writes visitor-controlled fields (User-Agent, Referer, and visited URL) directly into CSV cells without neutralizing formula-triggering characters (=, +, -, @, tab, carriage return). An unauthenticated attacker can craft a request to any short URL with malicious headers containing DDE or WEBSERVICE formula payloads. When an administrator exports visits to CSV via CLI commands (short-url:visits, visit:orphan, visit:non-orphan, tag:visits, domain:visits) and opens the file in a spreadsheet application that evaluates formulas, the injected formulas are executed in the context of the administrator's machine. The fix is to apply the League\Csv\EscapeFormula formatter before writing rows to escape formula-triggering characters.

Affected products

Shlink Shlink 5.0.0 through 5.1.5

Timeline

2026-08-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.