~ / search / GHSA-p85r-x2wj-mxqj

GHSA-p85r-x2wj-mxqj

shlink has a Server-Side Request Forgery issue

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-50887

Packages

EcosystemPackageAffectedFixed in
Packagist shlinkio/shlink <= 5.0.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.

References

External links from the advisory. They lead to third-party sites.