CVE-2025-54597 - LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter

HIGH

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter

Published Jul 27, 2025

7.2

HIGH

CVSS 3.1

EPSS 0.56%

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
0	affected	<2.7.3

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://github.com/linuxserver/Heimdall/commit/d1a96dd752ba30dc56380400dd2587d8abb8e9d1		Patch
https://github.com/linuxserver/Heimdall/compare/v2.7.2...v2.7.3		Patch

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Jul 27, 2025

Updated Jul 28, 2025

Reserved Jul 27, 2025

Updated Jul 28, 2025

Status Analyzed

Modified Jun 17, 2026

Severity n/a

Public date n/a