PT-2025-31395 · Heimdal · Heimdal

Jfoz1010 + 1 · Published 2025-07-30 · Updated 2026-04-02 · CVE-2025-50578

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions heimdall version 2.6.3-ls307

Description The application does not properly validate user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. This allows for Host Header Injection and Open Redirect attacks. An unauthenticated remote attacker can manipulate these headers to load external resources from attacker-controlled domains and redirect users, potentially enabling phishing, UI redress, and session theft. The issue is due to insufficient validation of untrusted input, impacting the application’s integrity and trustworthiness.

Recommendations Apply input validation and sanitization to the X-Forwarded-Host and Referer HTTP headers to prevent manipulation.

Exploit

Fix

RCE

Open Redirect

Special Elements Injection

Weakness Enumeration

CWE-601

CWE-20

CWE-74

Related Identifiers

CVE-2025-50578

Affected Products

Heimdal

References · 10

• 🔥 https://github.com/linuxserver/Heimdall/issues/1451 · Exploit
• 🔥 https://medium.com/@juanfelipeoz.rar/cve-2025-50578-exploiting-host-header-injection-open-redirect-in-heimdall-application-733afceff2ea · Exploit
• https://osv.dev/vulnerability/CVE-2025-50578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50578 · Security Note
• https://github.com/linuxserver/Heimdall · Note
• https://twitter.com/PwnedRar_/status/1950653533130203339 · Twitter Post
• https://t.me/CVEtracker/28756 · Telegram Post
• https://twitter.com/CVEnew/status/1950583873752232247 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2039538343667736829 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1950674023672602891 · Twitter Post