CVE-2026-107449: SSRF
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /testconfig (and GET /getstats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
Affected Software
Event History
Frequently Asked Questions
What conditions make an installation exploitable?
The issue depends on /test_config or /get_stats being reachable through CSRF in the deployment. Exploitation also requires user interaction, as reflected by the UI:R vector, and the attacker can then cause the server to request internal hosts and ports.
What can an attacker reach or learn through this behavior?
An attacker can induce requests to arbitrary internal hosts and ports, including the link-local 169.254.169.254 address. The behavior can expose a status and port oracle and partial response data.
Which application paths lack the stated SSRF IP-address restrictions?
The SafeUrlFetcher protections are applied only to ItemController. Enhanced-application testing and live-stat requests use SupportedApps::execute() through a GuzzleHttp client without the described IP-address restrictions.