shlink has a Server-Side Request Forgery issue

CRITICAL 9.1CVE-2026-50887 · GHSA-p85r-x2wj-mxqj · Published 15/06/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
shlinkio/shlink Packagist	`≤ 5.0.1`	No fix yet

Description

A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.

NVD description

A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.

References

nvd.nist.gov/vuln/detail/CVE-2026-50887 · ADVISORY
gist.github.com/pyuysig/9de95fb39eb089a4346570d791af99a6 · WEB
shlinkio/shlink · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free