Unexpected File Upload Vulnerability in Mozilla Firefox and Thunderbird for Windows

CVE-2025-3033

Summary

A vulnerability exists within Firefox and Thunderbird on Windows systems that allows a malicious .url shortcut from the local filesystem to trigger an unintentional file upload. This flaw specifically impacts versions prior to 137 and poses a risk primarily for users on the Windows platform, while other operating systems remain unaffected. Users and organizations are advised to update to the latest versions to mitigate potential risks associated with this vulnerability.

References