Vulnerability · Published Aug 3, 2026 · Assigned by VulnCheck

CVE-2026-18736Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution

Medium 5.0

In plain English

A medium-severity server-side request forgery in Shlink from shlinkio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.3%top 73.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information via the HTML title element returned in the short URL creation response.

Affected products (as reported)

Vendor	Product	Versions
shlinkio	Shlink	2.6.0 – through 5.1.5

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

GitHub Security Advisory vendor-advisory
Product Repository product
https://www.vulncheck.com/advisories/shlink-server-side-request-forgery-via-short-url-title-auto-resolution third-party-advisory