CVE-2022-31739
When downloading files on Windows, the % character was not escaped, which could have lead to a...
8.8 HighFix available
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>This bug only affects Firefox for Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.70%Down 0.2 points since Dec 23, 2022
What each source reports
NVD Score used
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>This bug only affects Firefox for Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
- Record
CVE-2022-31739- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-02
CVE List
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>This bug only affects Firefox for Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
- Record
CVE-2022-31739- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-02
EUVDEUVD-2022-53137
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>This bug only affects Firefox for Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
- Record
EUVD-2022-53137- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w6x2-rcr6-2hh6
When downloading files on Windows, the % character was not escaped, which could have lead to a...
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>This bug only affects Firefox for Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
- Record
GHSA-w6x2-rcr6-2hh6- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-31739
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>This bug only affects Firefox for Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
- Record
ALPINE-CVE-2022-31739- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-31739
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>This bug only affects Firefox for Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
- Record
UBUNTU-CVE-2022-31739- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVopenSUSE-SU-2024:12117-1 No score
MozillaThunderbird-91.10.0-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-91.10.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12117-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12121-1 No score
MozillaFirefox-101.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-101.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12121-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1920-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 91.10.0 ESR (MFSA 2022-21)(bsc#1200027)
- CVE-2022-31736: Cross-Origin resource's length leaked
- CVE-2022-31737: Heap buffer overflow in WebGL
- CVE-2022-31738: Browser window spoof using fullscreen mode
- CVE-2022-31739: Attacker-influenced path traversal when saving downloaded files
- CVE-2022-31740: Register allocation problem in WASM on arm64
- CVE-2022-31741: Uninitialized variable leads to invalid memory read
- CVE-2022-31742: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information
- CVE-2022-31747: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
- Record
SUSE-SU-2022:1920-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1921-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 91.10.0 ESR (MFSA 2022-21)(bsc#1200027)
- CVE-2022-31736: Cross-Origin resource's length leaked
- CVE-2022-31737: Heap buffer overflow in WebGL
- CVE-2022-31738: Browser window spoof using fullscreen mode
- CVE-2022-31739: Attacker-influenced path traversal when saving downloaded files
- CVE-2022-31740: Register allocation problem in WASM on arm64
- CVE-2022-31741: Uninitialized variable leads to invalid memory read
- CVE-2022-31742: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information
- CVE-2022-31747: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
- Record
SUSE-SU-2022:1921-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1927-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 91.10.0 ESR (MFSA 2022-21)(bsc#1200027)
- CVE-2022-31736: Cross-Origin resource's length leaked
- CVE-2022-31737: Heap buffer overflow in WebGL
- CVE-2022-31738: Browser window spoof using fullscreen mode
- CVE-2022-31739: Attacker-influenced path traversal when saving downloaded files
- CVE-2022-31740: Register allocation problem in WASM on arm64
- CVE-2022-31741: Uninitialized variable leads to invalid memory read
- CVE-2022-31742: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information
- CVE-2022-31747: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
- Record
SUSE-SU-2022:1927-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:2062-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 91.9.1
MFSA 2022-19 (bsc#1199768):
- CVE-2022-1802: Prototype pollution in Top-Level Await implementation (bmo#1770137).
- CVE-2022-1529: Untrusted input used in JavaScript object indexing, leading to prototype pollution (bmo#1770048).
Update to Mozilla Thunderbird 91.10
MFSA 2022-22 (bsc#1200027):
- CVE-2022-31736: Cross-Origin resource's length leaked (bmo#1735923)
- CVE-2022-31737: Heap buffer overflow in WebGL (bmo#1743767)
- CVE-2022-31738: Browser window spoof using fullscreen mode (bmo#1756388)
- CVE-2022-31739: Attacker-influenced path traversal when saving downloaded files (bmo#1765049)
- CVE-2022-31740: Register allocation problem in WASM on arm64 (bmo#1766806)
- CVE-2022-31741: Uninitialized variable leads to invalid memory read (bmo#1767590)
- CVE-2022-1834: Braille space character caused incorrect sender email to be shown for a digitally signed email (bmo#1767816)
- CVE-2022-31742: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information (bmo#1730434)
- CVE-2022-31747: Memory safety bugs fixed in Thunderbird 91.10 (bmo#1760765, bmo#1765610, bmo#1766283, bmo#1767365, bmo#1768559, bmo#1768734)
- Record
SUSE-SU-2022:2062-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxAlpine:v3.16 |
before 101.0-r0 | 101.0-r0 |
firefoxAlpine:v3.17 |
before 101.0-r0 | 101.0-r0 |
firefoxAlpine:v3.18 |
before 101.0-r0 | 101.0-r0 |
firefoxAlpine:v3.19 |
before 101.0-r0 | 101.0-r0 |
firefoxAlpine:v3.20 |
before 101.0-r0 | 101.0-r0 |
firefoxAlpine:v3.21 |
before 101.0-r0 | 101.0-r0 |
firefoxAlpine:v3.22 |
before 101.0-r0 | 101.0-r0 |
firefoxAlpine:v3.23 |
before 101.0-r0 | 101.0-r0 |
firefox-esrAlpine:v3.15 |
before 91.10.0-r0 | 91.10.0-r0 |
firefox-esrAlpine:v3.16 |
before 91.10.0-r0 | 91.10.0-r0 |
Show 71 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefox-esrAlpine:v3.17 |
before 91.10.0-r0 | 91.10.0-r0 |
firefox-esrAlpine:v3.18 |
before 91.10.0-r0 | 91.10.0-r0 |
firefox-esrAlpine:v3.19 |
before 91.10.0-r0 | 91.10.0-r0 |
firefox-esrAlpine:v3.20 |
before 91.10.0-r0 | 91.10.0-r0 |
firefox-esrAlpine:v3.21 |
before 91.10.0-r0 | 91.10.0-r0 |
firefox-esrAlpine:v3.22 |
before 91.10.0-r0 | 91.10.0-r0 |
firefox-esrAlpine:v3.23 |
before 91.10.0-r0 | 91.10.0-r0 |
librewolfAlpine:v3.21 |
before 101.0-r0 | 101.0-r0 |
librewolfAlpine:v3.22 |
before 101.0-r0 | 101.0-r0 |
librewolfAlpine:v3.23 |
before 101.0-r0 | 101.0-r0 |
librewolfAlpine:v3.24 |
before 101.0-r0 | 101.0-r0 |
thunderbirdAlpine:v3.16 |
before 91.10.0-r0 | 91.10.0-r0 |
thunderbirdAlpine:v3.17 |
before 91.10.0-r0 | 91.10.0-r0 |
thunderbirdAlpine:v3.18 |
before 91.10.0-r0 | 91.10.0-r0 |
thunderbirdAlpine:v3.19 |
before 91.10.0-r0 | 91.10.0-r0 |
thunderbirdAlpine:v3.20 |
before 91.10.0-r0 | 91.10.0-r0 |
thunderbirdAlpine:v3.21 |
before 91.10.0-r0 | 91.10.0-r0 |
thunderbirdAlpine:v3.22 |
before 91.10.0-r0 | 91.10.0-r0 |
thunderbirdAlpine:v3.23 |
before 91.10.0-r0 | 91.10.0-r0 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Manager Proxy 4.1 From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Manager Retail Branch Server 4.1 From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Manager Server 4.1 From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:Enterprise Storage 7 From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxopenSUSE:Leap 15.3 From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxopenSUSE:Leap 15.4 From an advisory covering 8 CVEs |
before 91.10.0-150200.152.43.1 | 91.10.0-150200.152.43.1 |
MozillaFirefoxSUSE:HPE Helion OpenStack 8 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:OpenStack Cloud 8 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:OpenStack Cloud 9 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 8 CVEs |
before 91.10.0-112.114.1 | 91.10.0-112.114.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaFirefoxSUSE:Enterprise Storage 6 From an advisory covering 8 CVEs |
before 91.10.0-150000.150.44.1 | 91.10.0-150000.150.44.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP3 From an advisory covering 11 CVEs |
before 91.10.0-150200.8.73.1 | 91.10.0-150200.8.73.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP4 From an advisory covering 11 CVEs |
before 91.10.0-150200.8.73.1 | 91.10.0-150200.8.73.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP3 From an advisory covering 11 CVEs |
before 91.10.0-150200.8.73.1 | 91.10.0-150200.8.73.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP4 From an advisory covering 11 CVEs |
before 91.10.0-150200.8.73.1 | 91.10.0-150200.8.73.1 |
MozillaThunderbirdopenSUSE:Leap 15.3 From an advisory covering 11 CVEs |
before 91.10.0-150200.8.73.1 | 91.10.0-150200.8.73.1 |
MozillaThunderbirdopenSUSE:Leap 15.4 From an advisory covering 11 CVEs |
before 91.10.0-150200.8.73.1 | 91.10.0-150200.8.73.1 |
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
mozjs68Ubuntu:20.04:LTS |
All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
mozjs78Ubuntu:22.04:LTS |
All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 |
None known |
mozjs91Ubuntu:22.04:LTS |
All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 |
None known |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 91.10.0-1.1 | 91.10.0-1.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 13 CVEs |
before 101.0-1.1 | 101.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31739 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published June 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in firefox 101.0-r0.
References
mozilla.org/security/advisories/mfsa2022-20
bugzilla.mozilla.org/show_bug.cgi?id=1765049
nvd.nist.gov/vuln/detail/CVE-2022-31739
github.com/advisories/GHSA-w6x2-rcr6-2hh6
Show 194 moreShow less
security.alpinelinux.org/vuln/CVE-2022-31739
suse.com/support/update/announcement/2022/suse-su-20221920-1
bugzilla.suse.com/1200027
ubuntu.com/security/CVE-2022-31739
cve.org/CVERecord?id=CVE-2022-31739
lists.opensuse.org/archives/list/[email protected]/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
This page doesn't list everything
Left out here: 1,680 references. The JSON record has them.