GitHub Advisoryadvisory · Packagist

GHSA-p85r-x2wj-mxqj shlink has a Server-Side Request Forgery issue

CRITICAL Published 2026-06-15 Modified 2026-08-27 Official page ↗
Aliases
CVE-2026-50887
Ecosystem
Packagist
Packages
shlinkio/shlink
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-918
Reviewed
2026-08-27

Affected packages

• Packagist shlinkio/shlink: <= 5.0.1 (no fix yet)

Description

A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.

Related

Alias · CVE (1)

  • CVE-2026-50887 A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References