CVE-2026-18738 Overview
CVE-2026-18738 is a CSV formula injection vulnerability affecting Shlink versions 5.0.0 through 5.1.5. Shlink is a self-hosted URL shortener that records visit metadata for analytics and CSV export. Unauthenticated remote attackers can inject spreadsheet formulas into exported visit data by sending crafted User-Agent, Referer, or request path headers beginning with =, +, -, or @. When an administrator exports the visits CSV and opens it in a spreadsheet application that evaluates formulas, embedded Dynamic Data Exchange (DDE) or WEBSERVICE payloads execute on the administrator's machine. The weakness is tracked as [CWE-1236: Improper Neutralization of Formula Elements in a CSV File].
Critical Impact
A single unauthenticated request against any short URL can plant formula payloads that execute client-side code when administrators open the exported CSV.
Affected Products
- Shlink 5.0.0 through 5.1.5
- Self-hosted Shlink instances exporting visit data as CSV
- Administrator workstations opening exported files in spreadsheet applications that evaluate formulas
Discovery Timeline
- 2026-08-03 - CVE-2026-18738 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-18738
Vulnerability Analysis
Shlink logs metadata for every visit to a short URL, including client-supplied headers such as User-Agent and Referer and the requested path. These values are written to storage without neutralization of leading formula characters. When an administrator invokes the visit export functionality, Shlink serializes the recorded values into CSV cells as-is. Spreadsheet applications treat any cell beginning with =, +, -, or @ as a formula and evaluate it on open. Attackers exploit this asymmetry between storage and rendering to move code from a network request into an interactive spreadsheet session on a privileged workstation.
Root Cause
The CSV export routine does not prefix untrusted string fields with a neutralizing character such as a single quote or a tab, and it does not reject or escape leading formula-triggering characters. The vulnerability is a rendering-context escape rather than a memory safety issue, aligning with [CWE-1236].
Attack Vector
An unauthenticated attacker issues an HTTP request to any short URL served by a vulnerable Shlink instance. The attacker sets the User-Agent, Referer, or URL path to a payload beginning with a formula character, for example a WEBSERVICE call for data exfiltration or a DDE invocation for command execution. Shlink stores the value verbatim. When an operator later exports visits to CSV and opens the file in Microsoft Excel, LibreOffice Calc, or a similar application that evaluates formulas, the payload runs in the user's security context. Exploitation requires user interaction to open the file, which is reflected in the CVSS 4.0 vector for this issue.
For technical details and a proof-of-concept, see the GitHub CSV Injection Exploit repository and the VulnCheck Advisory on Shlink.
Detection Methods for CVE-2026-18738
Indicators of Compromise
- HTTP requests to any short URL where the User-Agent or Referer header begins with =, +, -, or @.
- Requested paths whose first character is a formula trigger, particularly paths containing WEBSERVICE, DDE, cmd|, or HYPERLINK substrings.
- Exported CSV files from Shlink containing cells that start with formula characters in visit metadata columns.
- Outbound network connections from administrator workstations to attacker-controlled hosts shortly after opening a Shlink visit export.
Detection Strategies
- Inspect Shlink access logs and stored visit records for header and path values whose first character is =, +, -, or @.
- Scan generated CSV exports before distribution using a linter that flags cells beginning with formula triggers.
- Correlate spreadsheet application process launches with child processes such as cmd.exe, powershell.exe, or rundll32.exe on administrator endpoints.
Monitoring Recommendations
- Alert on Shlink visit-export CLI invocations and downstream file transfers to operator workstations.
- Monitor Excel and Calc processes for outbound HTTP requests initiated via WEBSERVICE or DDE, which are unusual in normal analyst workflows.
- Track upgrades of Shlink deployments and flag instances still running versions 5.0.0 through 5.1.5.
How to Mitigate CVE-2026-18738
Immediate Actions Required
- Upgrade Shlink to a version later than 5.1.5 that neutralizes formula-triggering characters in CSV exports.
- Purge or sanitize existing stored visit data whose User-Agent, Referer, or path fields begin with =, +, -, or @.
- Disable automatic formula evaluation and DDE in spreadsheet applications used by Shlink administrators.
- Restrict who can trigger the visit export CLI and who receives the resulting CSV files.
Patch Information
Refer to the Shlink GitHub repository for release notes and fixed versions addressing CVE-2026-18738. Review the VulnCheck Advisory on Shlink for advisory-level remediation guidance.
Workarounds
- Post-process CSV exports to prefix any cell beginning with =, +, -, or @ with a single quote before distribution.
- Open exported files in a text editor or a spreadsheet configured to import CSV as plain text with formulas disabled.
- Place a reverse proxy in front of Shlink to reject requests whose User-Agent, Referer, or path starts with a formula trigger.
- Convert exports to a non-formula format such as JSON or PDF prior to sharing with operators.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
