CVE-2026-18736— Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution
Possible ATT&CK Techniques 3AI
T1059 · Command and Scripting Interpreter T1071 · Application Layer Protocol T1598.002 · Spearphishing AttachmentGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18736
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution
Source: CVE Program / CVE List V5
Vulnerability Description
Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information via the HTML title element returned in the short URL creation response.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-18736
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18736
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18736 (1)
Other References for CVE-2026-18736 (2)
Same Patch Batch · shlinkio · 2026-08-03 · 3 CVEs total
| CVE-2026-18737 | 6.5 MEDIUM | Shlink Blind SQL Injection via tags/stats orderBy Parameter |
| CVE-2026-18738 | 4.7 MEDIUM | Shlink CSV Formula Injection via Visit Export CLI |
IV. Related Vulnerabilities
Same weakness: CWE-918
- CVE-2026-66325
Microsoft Edge (Chromium-based) Spoofing Vulnerability - CVE-2026-48331
Adobe Campaign Classic (ACC) | Server-Side Request Forgery ( - CVE-2026-18647
jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD serve - CVE-2026-69078
Server-Side Request Forgery and Local File Disclosure in CTI - CVE-2026-67311
Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redire
V. Comments for CVE-2026-18736
No comments yet