PT-2026-84528 · Mozilla · Thunderbird
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 153.2
Thunderbird versions prior to 155
Description
The
mail.allowed attachment hostnames advanced configuration setting is used in a regular expression without proper escaping. This flaw allows certain unintended hostnames to match the expression, potentially enabling the serving of remote attachments from unauthorized hosts.Recommendations
Update Thunderbird to version 153.2 or later.
Update Thunderbird to version 155 or later.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Thunderbird