CVE-2022-4055 Other in xdg-utils
Attackers can craft malicious mailto URLs to force Thunderbird to attach local files, bypassing user expectations and potentially leaking sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-4055?
CVE-2022-4055 is a high-severity vulnerability in xdg-utils, published on 18 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
Weakness: CWE-146
Which versions are affected by CVE-2022-4055?
It affects 1 product.
Linux distribution packages (3)
xdg-utils AlmaLinux:9 | All versions | 1.1.3-13.el9_6 |
xdg-utils Red Hat:enterprise_linux:9::appstream | All versions | 0:1.1.3-13.el9_6 |
xdg-utils Rocky Linux:9 | All versions | 0:1.1.3-13.el9_6 |
Products include Freedesktop Xdg-Utils.
How do I fix CVE-2022-4055?
Apply the vendor's patch.
Is CVE-2022-4055 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4055 exists.
Other vulnerabilities in xdg-utils
Sources
Also known as ALSA-2025:7672, AZL-11465, AZL-37063, CLSA-2026-1791563013, DEBIAN-CVE-2022-4055, ECHO-581a-b1a0-1cc4 and 6 more.