CVE-2025-3033

HIGH

Firefox < 137.0 - Arbitrary File Upload via Malicious .url Shortcut

Title source: llm

Description

After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 137 and Thunderbird 137.

References (3)

Core 3

Core References

Issue Tracking, Permissions Required

https://bugzilla.mozilla.org/show_bug.cgi?id=1950056

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-20/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-23/

Scores

CVSS v3 7.7

EPSS 0.0015

EPSS Percentile 4.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-73

Status published

Products (4)

mozilla/firefox < 137.0

Mozilla/Firefox 137

mozilla/thunderbird < 137.0

Mozilla/Thunderbird 137

Published Apr 01, 2025

Tracked Since Feb 18, 2026