CVE-2025-3033CWE-73

CVE-2025-3033

High · published April 1, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded.

*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 137 and Thunderbird 137.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00173 · 6.4th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2025-04-01T17:15Z
Affected products (2)
ProductVersionsFixed in
mozilla/firefox< 137.0137.0
mozilla/thunderbird< 137.0137.0
References (3)
https://bugzilla.mozilla.org/show_bug.cgi?id=1950056 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-20/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-23/ · [email protected]
EPSS history
Timeline
  • 01 APR 12:29Z
    Opening local .url files could lead to another file being opened
    cvelistv5