CVE-2025-2830 Overview
CVE-2025-2830 is an information disclosure vulnerability in Mozilla Thunderbird. Attackers can craft a malformed file name for an attachment inside a multipart email message. When the victim forwards or edits the message as new, Thunderbird includes a directory listing of the local /tmp directory in the outgoing content.
The issue affects Thunderbird on Linux and Windows. It can leak sensitive filenames, temporary artifacts, and system state to a remote attacker. Mozilla fixed the flaw in Thunderbird 137.0.2 and Thunderbird 128.9.2. The vulnerability is tracked under [CWE-22] path traversal-adjacent handling of attachment names.
Critical Impact
A single crafted email can coerce the victim's Thunderbird client into exfiltrating a directory listing of the local temporary directory back to the attacker when the message is forwarded or reused.
Affected Products
- Mozilla Thunderbird versions prior to 137.0.2
- Mozilla Thunderbird ESR versions prior to 128.9.2
- Thunderbird on Linux and Windows platforms
Discovery Timeline
- 2025-04-15 - CVE-2025-2830 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2830
Vulnerability Analysis
Thunderbird processes multipart MIME messages and stores attachments in a temporary directory before rendering or forwarding them. The client uses the attachment filename from the MIME headers when building forwarded or drafted content. A malformed filename causes Thunderbird to resolve the attachment reference against the /tmp directory itself rather than against a specific file. The rendered output then contains a directory listing of /tmp instead of the intended attachment content.
Exploitation requires user interaction. The attacker sends a message containing a crafted attachment. The disclosure occurs only when the victim forwards the message or opens it with the edit-as-new function. On Linux the listing exposes /tmp; comparable behavior occurs on Windows against the equivalent temporary path.
The leaked data can include filenames from other applications, session artifacts, downloaded files, and identifiers that reveal running software. This information supports targeted follow-on attacks against the same host.
Root Cause
The root cause is improper handling of untrusted filename strings in MIME attachment parts, classified as [CWE-22]. Thunderbird did not sufficiently sanitize or validate the filename before using it to locate the attachment payload on disk. A malformed value caused the resolver to fall back to the parent directory and enumerate its contents.
Attack Vector
The attack vector is network-based email delivery. An attacker sends a crafted multipart message to the target mailbox. The victim must forward the message or select edit as new. The directory listing is embedded into the newly composed message body, which the victim then sends to the attacker or another attacker-controlled recipient. See the Mozilla Bug Report #1956379 for the underlying issue tracking.
No verified exploit code has been published for CVE-2025-2830. Refer to the Mozilla Security Advisory MFSA-2025-26 and Mozilla Security Advisory MFSA-2025-27 for vendor details.
Detection Methods for CVE-2025-2830
Indicators of Compromise
- Outbound email messages from Thunderbird users containing text that resembles a filesystem directory listing of /tmp or a Windows temp path.
- Inbound multipart messages with attachment filename parameters containing path separators, null bytes, or otherwise malformed values.
- Sent-folder items where forwarded or edited-as-new messages contain unexpected system filenames not present in the original thread.
Detection Strategies
- Inspect the MIME headers of inbound messages at the mail gateway for Content-Dispositionfilename values containing traversal sequences or non-printable characters.
- Correlate Thunderbird process activity with reads of /tmp directory entries followed by outbound SMTP submissions to identify likely exploitation attempts.
- Deploy content inspection on outbound mail to flag messages containing directory-listing patterns such as sequences of file entries with sizes and timestamps.
Monitoring Recommendations
- Monitor Thunderbird client versions across the fleet and alert on hosts still running builds earlier than 137.0.2 or ESR earlier than 128.9.2.
- Log and review email gateway rejections and quarantines for messages with malformed MIME attachment metadata.
- Track user reports of unexpected content appearing when forwarding or editing messages, which can indicate exploitation attempts.
How to Mitigate CVE-2025-2830
Immediate Actions Required
- Upgrade Thunderbird to 137.0.2 or later, or Thunderbird ESR to 128.9.2 or later, on all managed endpoints.
- Instruct users to avoid forwarding or editing-as-new any suspicious multipart messages until patching is complete.
- Audit sent items for any messages that may have already leaked temporary directory contents to external recipients.
Patch Information
Mozilla addressed CVE-2025-2830 in Thunderbird 137.0.2 and Thunderbird ESR 128.9.2. Distribution details and fixed builds are documented in MFSA-2025-26 and MFSA-2025-27.
Workarounds
- Restrict use of the forward and edit-as-new actions on messages from untrusted senders until the client is updated.
- Configure mail gateway policies to strip or normalize Content-Dispositionfilename parameters that contain path separators or control characters.
- Reduce sensitive content in the operating system temporary directory by clearing /tmp on session start where operationally acceptable.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
