CVE-2026-18737

mediumCVSS 6.5covered by 1 sourcefirst seen 2026-08-03

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.

⚡ Watch CVE-2026-18737

Get an email if CVE-2026-18737 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumCVE-2026-18737: Shlink contains a blind SQL injection vulnerability that allows any authenticated API key hold…nvd · 2026-08-03

External references

NVD record for CVE-2026-18737

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-18737 status](https://www.csirts.com/badge/CVE-2026-18737)](https://www.csirts.com/cve/CVE-2026-18737)