CVE-2025-50578

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-50578
LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading of external resources from attacker-controlled domains and unintended redirection of users, potentially enabling phishing, UI redress, and session theft. The vulnerability exists due to insufficient validation and trust of untrusted input, affecting the integrity and trustworthiness of the application.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/linuxserver/Heimdall Product
https://github.com/linuxserver/Heimdall/issues/1451 Exploit Issue Tracking
https://medium.com/@juanfelipeoz.rar/cve-2025-50578-exploiting-host-header-injection-open-redirect-in-heimdall-application-733afceff2ea Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxserver:heimdall_application_dashboard:2.6.3-ls307:*:*:*:*:*:*:*
History

07 Aug 2025, 18:18

Type Values Removed Values Added
First Time Linuxserver heimdall Application Dashboard
Linuxserver
CPE cpe:2.3:a:linuxserver:heimdall_application_dashboard:2.6.3-ls307:*:*:*:*:*:*:*
References () https://github.com/linuxserver/Heimdall - () https://github.com/linuxserver/Heimdall - Product
References () https://github.com/linuxserver/Heimdall/issues/1451 - () https://github.com/linuxserver/Heimdall/issues/1451 - Exploit, Issue Tracking
References () https://medium.com/@juanfelipeoz.rar/cve-2025-50578-exploiting-host-header-injection-open-redirect-in-heimdall-application-733afceff2ea - () https://medium.com/@juanfelipeoz.rar/cve-2025-50578-exploiting-host-header-injection-open-redirect-in-heimdall-application-733afceff2ea - Exploit, Third Party Advisory

31 Jul 2025, 18:42

Type Values Removed Values Added
Summary
  • (es) LinuxServer.io heimdall 2.6.3-ls307 contiene una vulnerabilidad en la gestión de los encabezados HTTP proporcionados por el usuario, específicamente «X-Forwarded-Host» y «Referer». Un atacante remoto no autenticado puede manipular estos encabezados para realizar ataques de inyección de encabezado de host y redirección abierta. Esto permite la carga de recursos externos desde dominios controlados por el atacante y la redirección involuntaria de usuarios, lo que podría facilitar el phishing, la corrección de la interfaz de usuario y el robo de sesión. La vulnerabilidad existe debido a una validación y confianza insuficientes en entradas no confiables, lo que afecta la integridad y la fiabilidad de la aplicación.

30 Jul 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-30 16:15

Updated : 2025-08-07 18:18

NVD link : CVE-2025-50578

Mitre link : CVE-2025-50578

CVE.ORG link : CVE-2025-50578

JSON object : View

Products Affected

linuxserver

  • heimdall_application_dashboard
CWE
CWE-20

Improper Input Validation

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')