/Vulnerability Library

Heimdall - Host Header Injection & Open Redirect

CVE-2025-50578
Verified

Description

LinuxServer.io Heimdall 2.6.3-ls307 contains a host header injection caused by improper validation of user-supplied HTTP headers `X-Forwarded-Host` and `Referer`, letting unauthenticated remote attackers perform host header injection and open redirect attacks, exploit requires no special privileges.

Severity

Medium

Published Date

April 1, 2026

Template Author

dhiyaneshdk

CVE-2025-50578.yaml
5.0Severity

CVSS Metrics

References

https://github.com/linuxserver/Heimdall/issues/1451https://medium.com/@juanfelipeoz.rar/cve-2025-50578-exploiting-host-header-injection-open-redirect-in-heimdall-application-733afceff2ea

Remediation Steps

Update to the latest version of Heimdall.