CVE-2026-18737: Shlink Blind SQL Injection Vulnerability

CVE-2026-18737 Overview

CVE-2026-18737 is a blind SQL injection vulnerability [CWE-89] in Shlink, an open-source URL shortener. The flaw resides in the tag statistics REST endpoint, where the direction value inside the orderBy query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause. Any authenticated holder of a valid API key can inject arbitrary SQL fragments and extract data across tenants using time-based, boolean-oracle, and error-based techniques.

Critical Impact
Authenticated attackers can exfiltrate long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets belonging to any tenant on the affected Shlink instance.

Affected Products

Shlink (self-hosted URL shortener by shlinkio)
Shlink REST API endpoint GET /rest/v{version}/tags/stats
Deployments exposing the tag statistics endpoint to API key holders

Discovery Timeline

2026-08-03 - CVE-2026-18737 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18737

Vulnerability Analysis

The vulnerability affects the GET /rest/v{version}/tags/stats endpoint. Shlink accepts an orderBy query parameter that specifies a field and sort direction for the returned tag statistics. While the field portion is validated against a whitelist, the direction component is concatenated directly into the SQL statement generated by Doctrine's QueryBuilder.

Because the value is not constrained to ASC or DESC, an attacker can supply arbitrary SQL that becomes part of the final ORDER BY clause. The vulnerability requires only a low-privilege API key, and any authenticated tenant can reach data belonging to other tenants stored in the same backend database.

Root Cause

The root cause is missing input validation on the sort direction argument passed to a query builder. Doctrine's QueryBuilder does not automatically parameterize identifiers or ORDER BY fragments, so any string placed into that position is executed as SQL. The application layer failed to enforce a strict allowlist for the direction value before assembling the query.

Attack Vector

Exploitation is network-based and requires a valid API key. The attacker sends a crafted HTTP GET request to the tag statistics endpoint with an orderBy parameter whose direction portion contains a SQL subquery. Because the injection point is inside an ORDER BY clause, direct row output is not returned, so attackers rely on blind techniques.

Time-based inference uses SQL sleep or benchmark functions to signal a bit of extracted data through response latency. Boolean-oracle inference toggles ordering behavior based on a conditional expression, revealing bits through row order changes. Error-based extraction forces database errors that leak values in response bodies. Public proof-of-concept code is available at the GitHub SQL Injection Exploit repository.

Detection Methods for CVE-2026-18737

Indicators of Compromise

HTTP requests to /rest/v*/tags/stats containing unusual characters such as parentheses, commas, or SQL keywords in the orderBy parameter
Long-duration responses from the tag statistics endpoint suggesting time-based inference with SLEEP() or BENCHMARK()
Repeated authenticated requests from a single API key with incrementing or bit-flipping payload variations
Database error responses returned from tag statistics requests

Detection Strategies

Deploy web application firewall rules that flag SQL tokens such as SELECT, UNION, SLEEP, IF(, or CASE WHEN in the orderBy query parameter
Baseline normal response times for /rest/v*/tags/stats and alert on statistical outliers indicative of blind timing attacks
Correlate API key usage patterns to identify a single key issuing high volumes of tag statistics requests with unique parameters

Monitoring Recommendations

Enable verbose query logging on the backend database and review ORDER BY clauses referencing the tags and related statistics tables
Forward Shlink application logs and reverse proxy access logs to a centralized analytics platform for query anomaly detection
Monitor for unauthorized reads of the api_keys table or columns storing hashed secrets

How to Mitigate CVE-2026-18737

Immediate Actions Required

Update Shlink to the patched release listed in the VulnCheck advisory
Rotate all Shlink API keys, since hashed secrets may have been exfiltrated by any authenticated tenant
Audit database and application logs for suspicious requests to the tag statistics endpoint dating back to the deployment of the vulnerable version
Restrict network exposure of the Shlink REST API to trusted clients where feasible

Patch Information

Refer to the Shlink project repository for the fixed release and changelog. The upstream fix enforces a strict allowlist on the direction component of orderBy and ensures identifiers are safely handled by the Doctrine QueryBuilder. Review the VulnCheck advisory for version-specific guidance.

Workarounds

Block or reverse-proxy filter requests to /rest/v*/tags/stats that include characters or keywords outside of asc and desc in the orderBy parameter
Temporarily revoke API keys for untrusted tenants until the patched version is deployed
Place the Shlink API behind an authenticated reverse proxy that inspects query parameters and rejects suspicious payloads

bash

# Example NGINX rule to block non-alphanumeric orderBy direction values
location ~ ^/rest/v[0-9]+/tags/stats$ {
    if ($arg_orderBy ~* "[^a-zA-Z0-9\-_]") {
        return 400;
    }
    proxy_pass http://shlink_backend;
}