Open-source package vulnerability · Composer (PHP)
CVE-2026-50887: shlink has a Server-Side Request Forgery issue
criticalCVSS 3.1 9.1GHSA-p85r-x2wj-mxqj
A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.
Published Jun 15, 2026 · Updated Aug 27, 2026
Affected packages
shlinkio/shlink
- Ecosystem
- Composer (PHP)
- Affected
- <= 5.0.1
- Fixed in
- No patched version yet
- Check
composer show shlinkio/shlink
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology