linuxserver heimdall application dashboard vulnerabilities

Latest linuxserver heimdall application dashboard CVEs

Newest publication first

1. CVE-2025-54597 LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.

   Published 2025-07-27

   Medium·CVSS 6.1 EPSS 0.61%

   LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.

2. CVE-2024-51358 An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application.

   Published 2024-11-05

   Critical·CVSS 9.8 EPSS 0.95%

   An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application.

3. CVE-2023-51803 LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring.

   Published 2024-03-31

   Critical·CVSS 9.8 EPSS 0.70%

   LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring.

4. CVE-2022-47968 Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.

   Published 2022-12-27

   Medium·CVSS 5.4 EPSS 0.43%

   Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.