CVE-2026-50887

Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability exists in Shlink v5.0.1 (AUTO_RESOLVE_TITLES configuration option enabled). When creating or editing a short URL without an explicit title, the longUrl field is passed to the title resolution helper, which issues a server-side GET request to the domain extracted from the longUrl [1]. The application validates that the value is URL-shaped but does not block internal addresses before the fetch, allowing an attacker to specify http://127.0.0.1:8080/ or other internal destinations.

Exploitation

An attacker must have a valid API key (authentication is required). The conditions are that AUTO_RESOLVE_TITLES is true and no title parameter is supplied in the short URL creation or edit request [1]. The attacker sets the longUrl to an internal resource (e.g., http://192.168.1.1/admin). The Shlink server then sends a GET request to that internal address. The attacker can set up a listener on an internal service to receive this connection [1]. If the target returns HTML with a `` tag, that title value is stored and potentially returned in the short URL response, enabling limited information disclosure.

Impact

Successful exploitation grants an authenticated attacker the ability to probe internal network services that are reachable from the Shlink server. The attacker can discover open ports, identify running services, and potentially extract a fragment of information through the resolved page title [1]. This can aid in further attacks against internal infrastructure.

Mitigation

As of the available references, no official patch has been released for Shlink v5.0.1 [1]. The workaround is to disable AUTO_RESOLVE_TITLES in the configuration, or to always supply an explicit title when creating or editing short URLs. If the feature is required, restrict outbound network access from the Shlink server (e.g., using a firewall or proxy rules) to prevent connections to private IP ranges.