Every CVE Search/ Get API key

CVE-2020-27748

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling...

6.5 MediumFix available

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.44%Up 0.8 points since Jun 2, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Record
CVE-2020-27748
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
CVE List No score

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Record
CVE-2020-27748
Weakness
CWE-201
Updated
2026-11-02
EUVDEUVD-2020-20252 No score

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Record
EUVD-2020-20252
Updated
2026-11-03
GitHub AdvisoriesGHSA-3c8x-jg6w-85xx No score

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling...

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Record
GHSA-3c8x-jg6w-85xx
Weakness
CWE-201
Updated
2026-11-02
OSVAZL-37062 6.5

CVE-2020-27748 affecting package xdg-utils 1.2.1-3

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Record
AZL-37062
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-05
OSVAZL-7424 6.5

CVE-2020-27748 affecting package xdg-utils 1.1.3-7

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Record
AZL-7424
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 8 moreShow less
OSV 6.5

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Record
CVE-2020-27748
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-27748 6.5

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Record
DEBIAN-CVE-2020-27748
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2021-1228 6.1

xdg-utils security update

The xdg-utils package is a set of simple scripts that provide basic desktop integration functions for any Free Desktop, such as Linux. The following tools are included in xdg-utils: * xdg-desktop-menu Install desktop menu items * xdg-desktop-icon Install icons to the desktop * xdg-icon-resource Install icon resources * xdg-mime Query information about file type handling and install descriptions for new file types * xdg-open Open a file or URL in the user's preferred application * xdg-email Send mail using the user's preferred e-mail composer * xdg-screensaver Control the screensaver

Security Fix(es):

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.(CVE-2020-27748)

Record
OESA-2021-1228
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-27748 6.5

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Record
UBUNTU-CVE-2020-27748
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVCLSA-2025-1751913634 No score

xdg-utils: Fix of 2 CVEs

  • xdg-email: disable special support for Thunderbird to address following vulnerabilities:
  • CVE-2020-27748: local file inclusion vulnerability
  • CVE-2022-4055: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments
Record
CLSA-2025-1751913634
Updated
2026-11-02
OSVMGASA-2020-0446 No score

Updated xdg-utils package fixes a security vulnerability

Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive information (CVE-2020-27748).

Record
MGASA-2020-0446
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2020-27748 No score

CVE-2020-27748 in xdg-utils - Patched by Root

Root has patched CVE-2020-27748 in the xdg-utils package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2020-27748
Updated
2026-11-02
OSVUSN-4649-1 No score

xdg-utils vulnerability

Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive information.

Record
USN-4649-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xdg-utils
Azure Linux:3
 through 1.2.1-3 None known
xdg-utils
Azure Linux:2
 through 1.1.3-7 None known
xdg-utils
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1.1.3-11.el9.tuxcare.els1
1.1.3-11.el9.tuxcare.els1
xdg-utils
Debian:12
 All versions, plus listed versions
1.1.3-4.11.2.1-11.2.1-2
 None known
xdg-utils
Debian:13
 All versions, plus listed versions
1.2.1-2
 None known
xdg-utils
Debian:14
 All versions, plus listed versions
1.2.1-2
 None known
xdg-utils
Mageia:7
 before 1.1.3-3.1.mga7
1.1.3-3.1.mga7
xdg-utils
openEuler:20.03-LTS-SP1
 before 1.1.3-5.oe1
1.1.3-5.oe1
xdg-utils
Root:Debian:12
 before 1.1.3-4.1.aikido.12
1.1.3-4.1.aikido.121.1.3-4.1.root.io.41.1.3-4.1.root.io.51.1.3-4.1.root.io.71.1.3-4.1.root.io.81.1.3-4.1.root.io.91.1.3-4.1.root.io.101.1.3-4.1.root.io.21.1.3-4.1.root.io.31.1.3-4.1.root.io.61.1.3-4.1.root.io.11
rootio-xdg-utils
Root:Debian:12
 before 1.1.3-4.1.aikido.12
1.1.3-4.1.aikido.121.1.3-4.1.root.io.41.1.3-4.1.root.io.51.1.3-4.1.root.io.71.1.3-4.1.root.io.81.1.3-4.1.root.io.91.1.3-4.1.root.io.101.1.3-4.1.root.io.21.1.3-4.1.root.io.31.1.3-4.1.root.io.61.1.3-4.1.root.io.11
Show 6 moreShow less
Affected packages
PackageAffectedFixed
xdg-utils
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.0~rc3+git20150907-1ubuntu21.1.0~rc3+git20150907-1ubuntu31.1.1-1ubuntu11.1.1-1ubuntu1.16.04.11.1.1-1ubuntu1.16.04.31.1.1-1ubuntu1.16.04.41.1.1-1ubuntu1.16.04.5
 None known
xdg-utils
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.1-1ubuntu21.1.1-1ubuntu31.1.2-1ubuntu11.1.2-1ubuntu21.1.2-1ubuntu2.21.1.2-1ubuntu2.31.1.2-1ubuntu2.41.1.2-1ubuntu2.5
 None known
xdg-utils
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.1.3-1ubuntu21.1.3-2ubuntu11.1.3-2ubuntu1.20.04.11.1.3-2ubuntu1.20.04.2
 None known
xdg-utils
Ubuntu:16.04:LTS
 before 1.1.1-1ubuntu1.16.04.4, plus listed versions
1.1.0~rc3+git20150907-1ubuntu21.1.0~rc3+git20150907-1ubuntu31.1.1-1ubuntu11.1.1-1ubuntu1.16.04.11.1.1-1ubuntu1.16.04.3
1.1.1-1ubuntu1.16.04.4
xdg-utils
Ubuntu:18.04:LTS
 before 1.1.2-1ubuntu2.4, plus listed versions
1.1.1-1ubuntu21.1.1-1ubuntu31.1.2-1ubuntu11.1.2-1ubuntu21.1.2-1ubuntu2.21.1.2-1ubuntu2.3
1.1.2-1ubuntu2.4
xdg-utils
Ubuntu:20.04:LTS
 before 1.1.3-2ubuntu1.20.04.1, plus listed versions
1.1.3-1ubuntu21.1.3-2ubuntu1
1.1.3-2ubuntu1.20.04.1

History

History
RecordedChangedSources
affected
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-27748 is a medium vulnerability (CVSS 6.5) in Freedesktop Xdg-utils, published November 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in xdg-utils 1.1.3-3.1.mga7.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open