Vulnerability · Published Aug 3, 2026 · Assigned by VulnCheck

CVE-2026-18737Shlink Blind SQL Injection via tags/stats orderBy Parameter

Medium 6.5

In plain English

A medium-severity SQL injection in Shlink from shlinkio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 65.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.

Affected products (as reported)

Vendor	Product	Versions
shlinkio	Shlink	3.3.1 – through 5.1.5

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory vendor-advisory
Product Repository product
https://www.vulncheck.com/advisories/shlink-blind-sql-injection-via-tags-stats-orderby-parameter third-party-advisory