CVE-2026-18738

Shlink 5.0.0–5.1.5 is affected by a CSV formula injection via visit export (CLI). An unauthenticated attacker can send a single request with malicious values in headers (User-Agent, Referer, or request path) that start with =, +, -, or @, causing embedded DDE/WEBSERVICE payloads in CSV cells. Whe...