CVE-2025-3033: Opening local .url files could lead to another file being opened
After selecting a malicious Windows .url shortcut from the local filesystem, an unexpected file could be uploaded. This bug only affects Firefox on Windows. Other operating systems are unaffected.
Other sources
After selecting a malicious Windows .url shortcut from the local filesystem, an unexpected file could be uploaded. This bug only affects Thunderbird on Windows. Other operating systems are unaffected.
— Mozilla
After selecting a malicious Windows .url shortcut from the local filesystem, an unexpected file could be uploaded. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 137 and Thunderbird 137.
— MITRE
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-3033?
CVE-2025-3033 has been classified as a moderate severity vulnerability affecting Firefox on Windows.
How do I fix CVE-2025-3033?
To mitigate CVE-2025-3033, users should update Firefox or Thunderbird to version 137 or later.
What systems are affected by CVE-2025-3033?
CVE-2025-3033 specifically affects the Firefox and Thunderbird applications on Windows operating systems.
What type of vulnerability is CVE-2025-3033?
CVE-2025-3033 is a file upload vulnerability that occurs when a malicious Windows .url shortcut is selected.
Can I be attacked by CVE-2025-3033 if I use a different operating system?
No, CVE-2025-3033 only affects Windows systems; other operating systems are not at risk from this vulnerability.