PT-2025-14108

CVE-2025-3033

Published

2025-04-01

Updated

2026-10-22

Description by

CVSS 3.1

7.7

High

MetricsAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 137 Thunderbird versions prior to 137

Description The issue allows an unexpected file to be uploaded after selecting a malicious Windows .url shortcut from the local filesystem. This bug only affects Firefox on Windows, with other operating systems being unaffected.

Recommendations For Firefox versions prior to 137, update to version 137 or later to resolve the issue. For Thunderbird versions prior to 137, update to version 137 or later to resolve the issue.

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-73: External Control of File Name or Path

Related identifiers

CVE-2025-3033

BDU:2025-08235

ALT-PU-2025-11100