Description
Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator-s client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.
CVSS 4.7EPSS 0.381%Risque 0.49
Voir la source- Publication
- 2026-08-03 21:16:38
- Dernière modification
- 2026-08-04 16:16:22
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N