VulnSocial

CVE-2026-18738Disclosure

LOWCVSS 5.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator's client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1236

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-08-03: 2Technical Details · 2026-08-03: 208-03
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-18738 Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into expo… https://www.cve.org/CVERecord?id=CVE-2026-18738

    Post summary

    The tweet announces the discovery of CVE-2026-18738, a CSV formula injection that allows unauthenticated remote exploitation in Shlink 5.x. No proof‑of‑concept, exploit code, patch, or active exploitation details are provided.

    000212.0K
    58.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-18738 Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into expo… https://www.cve.org/CVERecord?id=CVE-2026-18738 ----- Traducción: CVE-2026-18738 Shl… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑18738, a CSV formula injection flaw in Shlink 5.x that allows unauthenticated remote attackers to inject spreadsheet formulas.

    0000038
    96 followersView on X

Explore more

Back to dashboard