CVE-2026-18737: Shlink Blind SQL Injection via tags/stats orderBy Parameter
Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18737?
The severity of CVE-2026-18737 is rated medium with a score of 6.5.
How does the CVE-2026-18737 vulnerability occur?
CVE-2026-18737 occurs due to a blind SQL injection vulnerability in Shlink when unvalidated input is used in the orderBy parameter of the tag statistics endpoint.
Who is affected by CVE-2026-18737?
CVE-2026-18737 affects any authenticated API key holders using Shlink due to the vulnerability in the orderBy query parameter.
How do I fix CVE-2026-18737?
To fix CVE-2026-18737, ensure that input validation is properly implemented for the orderBy parameter to prevent SQL injection.
What can attackers do with CVE-2026-18737?
Attackers can exploit CVE-2026-18737 to execute arbitrary SQL commands, potentially compromising the database.