← Database

CVE-2025-3033

HIGH CVSS: 7.7 Published: 2025-04-01 Modified: 2026-06-17

Description

After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 137 and Thunderbird 137.

Affected Platforms

Mozilla FirefoxMozilla Thunderbird

Weakness Type

CWE-73

References