Improper URL Parsing in Mailto Implementation Affects XDG Utils by FreeDesktop

CVE-2022-4055

What is CVE-2022-4055?

The improper parsing of mailto URLs in XDG Utils can permit an attacker to craft a deceptive URL that appears legitimate to users. When combined with Thunderbird as the configured mail client, additional headers may be unintentionally included that allow the attachment of files without the user's awareness. This behavior contradicts the standards outlined in RFC 2368, posing risks to user security and privacy.

References