4 matches found
CVE-2026-107449
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute, a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST...
CVE-2026-107449
The linuxserver Heimdall application (through version 2.8.3 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the SafeUrlFetcher protection is only applied to the ItemController , while the SupportedApps::execute() function uses a GuzzleHttp client without IP address ...
CVE-2026-107449
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute, a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST...
