CVE-2025-2830: Information Disclosure of /tmp directory listing
By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-2830?
CVE-2025-2830 is classified as a high-severity vulnerability due to its potential to disclose sensitive information.
How do I fix CVE-2025-2830?
To mitigate CVE-2025-2830, update Thunderbird to version 137.0.3 or later.
What does CVE-2025-2830 affect?
CVE-2025-2830 affects Mozilla Thunderbird versions 137.0.2 and earlier as well as 128.9.2 and earlier.
How does CVE-2025-2830 work?
CVE-2025-2830 allows attackers to include a directory listing of the /tmp directory by crafting malformed file names in attachments.
Can CVE-2025-2830 be exploited remotely?
Yes, CVE-2025-2830 can be exploited remotely through manipulated multipart messages.