{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"5.0.1"}],"component":"shlinkio/shlink","cve_ids":["CVE-2026-50887"],"ecosystem":"Packagist","epss":0.00287,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-p85r-x2wj-mxqj","id":"tcs_01M5KF66JQT67MVGJZKJM1R5CK","modified_at":"2026-08-27T16:55:36.930119Z","published_at":"2026-06-15T21:30:41Z","references":["https://osv.dev/vulnerability/GHSA-p85r-x2wj-mxqj","https://nvd.nist.gov/vuln/detail/CVE-2026-50887","https://gist.github.com/pyuysig/9de95fb39eb089a4346570d791af99a6","https://github.com/shlinkio/shlink"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-p85r-x2wj-mxqj","url":"https://osv.dev/vulnerability/GHSA-p85r-x2wj-mxqj"}],"summary":"shlink has a Server-Side Request Forgery issue"}