Vulnerabilities

TI-2026-69552 CVE-2026-107449

Server-side request forgery in linuxserver Heimdall test endpoints

MEDIUM 50

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp clien…

CVSS 3.1LOW 3.4 Network No auth User interaction EPSS 0.00162 Published 2026-10-08 No fix listed CWE-918

TI-2025-32167 CVE-2025-50578 · GHSA-2c6m-gpf4-cfgp

LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles…

HIGH 82

LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.031 Published 2025-07-30 No fix listed CWE-20

TI-2025-34368 CVE-2025-54597 · GHSA-3x9c-53jf-h89x

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.

LOW 39

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00606 Published 2025-07-27 Fixed in 2.7.3 CWE-79

TI-2022-23767 CVE-2022-47968 · GHSA-9q9r-fmgh-vv5v

Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via…

MEDIUM 58

Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00432 Published 2022-12-27 No fix listed CWE-79

Vulnerabilities

Filters

Server-side request forgery in linuxserver Heimdall test endpoints

LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles…

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.

Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via…