CVE-2025-55032

Focus incorrectly ignores Content-Disposition headers for some MIME types

Medium · published August 19, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks. This vulnerability was fixed in Focus for iOS 142.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.6th percentile
Published
2025-08-19T20:52Z
EPSS history
Timeline
  • 19 AUG 20:52Z
    Focus incorrectly ignores Content-Disposition headers for some MIME types
    cvelistv5