/Vulnerability Library

Heimdall Application Dashboard < 2.7.3 - Reflected XSS

CVE-2025-54597
Verified

Description

LinuxServer.io Heimdall < 2.7.3 contains a stored XSS caused by improper sanitization of the \"q\" parameter, letting remote attackers execute scripts, exploit requires crafted input.

Severity

Medium

CVSS Score

6.1

Exploit Probability

1%

Affected Product

heimdall

Published Date

March 31, 2026

Template Author

0x_akoko

CVE-2025-54597.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2025-54597
CWE ID:
cwe-79

References

https://nvd.nist.gov/vuln/detail/CVE-2025-54597https://github.com/linuxserver/Heimdall/releases/tag/v2.7.3https://github.com/linuxserver/Heimdall/commit/6b9f61b0e672c37b807ff338e1a3fdaa8f39a8a6

Remediation Steps

Update to version 2.7.3 or later.