CVE-2025-54597: Heimdall Application Dashboard XSS Flaw

CVE-2025-54597 Overview

CVE-2025-54597 is a reflected cross-site scripting (XSS) vulnerability in LinuxServer.io Heimdall application dashboard versions prior to 2.7.3. The flaw resides in the search functionality, where the q parameter processed by SearchController.php is rendered without proper output encoding. An attacker can craft a malicious URL that, when clicked by an authenticated user, executes arbitrary JavaScript in the victim's browser context. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, enabling session theft, credential harvesting, and unauthorized actions within the Heimdall dashboard.

Affected Products

LinuxServer.io Heimdall Application Dashboard versions before 2.7.3
Self-hosted Heimdall instances running vulnerable container images
Deployments exposing the Heimdall search endpoint to untrusted users

Discovery Timeline

2025-07-27 - CVE-2025-54597 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54597

Vulnerability Analysis

The vulnerability exists in Heimdall's search controller, which accepts a user-supplied q query parameter and reflects it back into the rendered response without sanitization. Because the input flows into HTML output as raw content, an attacker can inject JavaScript payloads through a crafted URL. When a Heimdall user visits the attacker-controlled link, the browser interprets the injected markup and executes the script in the origin of the Heimdall instance.

The scope-changed component of the vulnerability reflects that injected scripts run within the trusted origin of the Heimdall dashboard. Attackers can leverage this to read session tokens, modify dashboard entries, or pivot to internal services that Heimdall proxies. Exploitation requires user interaction, typically via phishing or a malicious link embedded in another site.

Root Cause

The root cause is missing output encoding on the q request parameter in app/Http/Controllers/SearchController.php. The controller passed the raw query string to the view layer, allowing HTML and JavaScript in the input to be rendered verbatim. The fix applies htmlspecialchars with ENT_QUOTES and UTF-8 encoding to neutralize special characters before the value reaches any template.

Attack Vector

An attacker constructs a URL to the Heimdall search endpoint containing a script payload in the q parameter and delivers it to a target user through email, chat, or a compromised website. When the victim clicks the link, Heimdall reflects the payload into the response and the browser executes it. No authentication is required to craft the link, but the victim's browser session determines the impact.

php

// Security patch in app/Http/Controllers/SearchController.php
        $requestprovider = $request->input('provider');
        $query = $request->input('q');

+       // Sanitize the query to prevent XSS
+       $query = htmlspecialchars($query, ENT_QUOTES, 'UTF-8');
+
        // Validate the presence and non-emptiness of the query parameter
        if (!$query || trim($query) === '') {
            abort(400, 'Missing or empty query parameter');
// Source: https://github.com/linuxserver/Heimdall/commit/d1a96dd752ba30dc56380400dd2587d8abb8e9d1

Detection Methods for CVE-2025-54597

Indicators of Compromise

HTTP requests to Heimdall's search endpoint containing <script>, onerror=, onload=, or javascript: substrings in the q parameter
URL-encoded payloads such as %3Cscript%3E or %22%3E%3Csvg targeting the q parameter
Unusual outbound requests from browser sessions immediately following a visit to a Heimdall search URL
Referer headers pointing to external phishing domains preceding search requests

Detection Strategies

Inspect web server and reverse proxy logs for requests to /search with suspicious characters in the q parameter
Deploy a web application firewall rule to flag common XSS signatures targeting Heimdall query parameters
Correlate Heimdall access logs with browser telemetry to identify sessions that received reflected payloads
Monitor Content Security Policy (CSP) violation reports if a policy is configured on the Heimdall origin

Monitoring Recommendations

Alert on repeated 400 responses from the Heimdall search endpoint, which may indicate payload probing
Track user-agent and source IP patterns for search requests to identify scanning activity
Log full request URIs for the Heimdall application to preserve evidence of injected payloads

How to Mitigate CVE-2025-54597

Immediate Actions Required

Upgrade Heimdall to version 2.7.3 or later, which applies htmlspecialchars encoding to the q parameter
Rotate any session cookies or API tokens for users who may have clicked untrusted search links
Restrict Heimdall exposure to trusted networks or authenticated users via reverse proxy access controls
Review Heimdall dashboard entries for unauthorized modifications introduced through scripted actions

Patch Information

The vendor released version 2.7.3 containing the fix. The patch is available in the GitHub Commit Update and reviewable through the GitHub Version Comparison. The commit sanitizes the search query with htmlspecialchars($query, ENT_QUOTES, 'UTF-8') before further processing.

Workarounds

Place Heimdall behind a reverse proxy with a web application firewall configured to strip HTML metacharacters from the q parameter
Enforce a strict Content Security Policy that disallows inline scripts on the Heimdall origin
Limit access to Heimdall to authenticated users on trusted networks until the upgrade is completed

bash

# Update Heimdall container to the patched release
docker pull lscr.io/linuxserver/heimdall:2.7.3
docker stop heimdall && docker rm heimdall
docker run -d --name=heimdall \
  -e PUID=1000 -e PGID=1000 -e TZ=Etc/UTC \
  -p 80:80 -p 443:443 \
  -v /path/to/config:/config \
  --restart unless-stopped \
  lscr.io/linuxserver/heimdall:2.7.3