Shlink contains a blind SQL injection flaw that permits any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. The malicious payload is placed unsanitized into a Doctrine QueryBuilder ORDER BY clause, allowing attackers to perform time‑based, boolean‑oracle, or error‑based techniques to recover sensitive data. The exposed information can include long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API‑key secrets belonging to any tenant. This vulnerability represents a confidentiality breach that can compromise the entire tenant database and is classified as CWE‑89.

The affected product is Shlink from shlinkio. No specific version numbers are provided in the available data, so all installations of Shlink that expose the tag statistics endpoint are presumed at risk until a patch is applied.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting no confirmed public exploitation yet. Exploitation requires a valid API key, implying that any user who can obtain or guess an API key may use it to conduct the injection. The attacker has full read‑only or operational access to tenant data through the compromised endpoint, which can lead to large‑scale data leakage.