CVE-2025-2830

Katalog CVE

CVSS 6.3 · Medium EPSS 0,35%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada mozilla thunderbird. Skor CVSS 3.1 6.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

Rincian

Terbit di NVD

15 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2025-26/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2025-27/ advisory vendor
• https://bugzilla.mozilla.org/show_bug.cgi?id=1956379 permissions required