PatchTheCVElinuxserver vulnerabilities
Recent CVEs affecting linuxserver products. 2 tracked.
linuxserver has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-07-30. Highest priority: CVE-2025-50578 (score 74/100).
- CVE-2025-54597 HIGH 7.2 UPGRADE LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.
- CVE-2025-50578 CRITICAL 9.8 DOWNGRADE LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, spe
FAQ
How do I fix linuxserver vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is linuxserver being exploited right now?
None of the tracked linuxserver CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which linuxserver CVE should I patch first?
CVE-2025-50578 currently ranks highest (74/100): LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, spe.