CVE-2025-2830 Information Disclosure of /tmp directory listing

What is CVE-2025-2830?

CVE-2025-2830 is a medium-severity vulnerability in Mozilla Thunderbird, published on 15 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

Weakness: CWE-22

Which versions are affected by CVE-2025-2830?

It affects 1 product.

Products include Mozilla Thunderbird.

How do I fix CVE-2025-2830?

Upgrade to a fixed version.

Is CVE-2025-2830 being exploited?

There is no known exploitation of CVE-2025-2830 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Thunderbird

• CVE-2026-92238 Ambiguous parsing of mail headers Critical 9.8
• CVE-2026-84637 Calendar invitation attachments could launch local executables Critical 9.8
• CVE-2021-43529 Memory corruption in Thunderbird Critical 9.8
• CVE-2019-11703 Memory corruption in Thunderbird Critical 9.8
• CVE-2019-11704 Memory corruption in Thunderbird Critical 9.8

All Mozilla Thunderbird vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-2830, GHSA-g6gh-87cw-x396, UBUNTU-CVE-2025-2830.