Every CVE Search/ Get API key

CVE-2022-4055

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can...

7.4 HighFix available

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.69%Down 0.2 points since Nov 19, 2022
90%50%10%1%

What each source reports

NVD Score used 7.4

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Record
CVE-2022-4055
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-146
Updated
2026-11-02
CVE List 7.4

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Record
CVE-2022-4055
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-146
Updated
2026-11-02
EUVDEUVD-2022-51432 7.4

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Record
EUVD-2022-51432
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-p4jr-wm76-h2v3 7.4

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can...

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Record
GHSA-p4jr-wm76-h2v3
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-146
Updated
2026-11-02
OSVAZL-11465 7.4

CVE-2022-4055 affecting package xdg-utils 1.1.3-7

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Record
AZL-11465
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVAZL-37063 7.4

CVE-2022-4055 affecting package xdg-utils for versions less than 1.2.1-3

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Record
AZL-37063
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
Show 10 moreShow less
OSV 7.4

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Record
CVE-2022-4055
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-146
Updated
2026-11-02
OSVRHSA-2025:7672 7.4

Red Hat Security Advisory: xdg-utils security update

Record
RHSA-2025:7672
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2025:7672 7.4

Moderate: xdg-utils security update

The xdg-utils package is a set of simple scripts that provide basic desktop integration functions for any Free Desktop.

Security Fix(es):

  • xdg-utils: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments (CVE-2022-4055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:7672
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2022-4055 7.4

CVE-2022-4055 in xdg-utils - Patched by Root

Root has patched CVE-2022-4055 in the xdg-utils package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2022-4055
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2022-4055 7.4

CVE-2022-4055 in xdg-utils - Patched by Root

Root has patched CVE-2022-4055 in the xdg-utils package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2022-4055
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2022-4055 7.4

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Record
UBUNTU-CVE-2022-4055
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2025:7672 No score

Moderate: xdg-utils security update

The xdg-utils package is a set of simple scripts that provide basic desktop integration functions for any Free Desktop.

Security Fix(es):

  • xdg-utils: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments (CVE-2022-4055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:7672
Updated
2026-11-02
OSVCLSA-2025-1751913634 No score

xdg-utils: Fix of 2 CVEs

  • xdg-email: disable special support for Thunderbird to address following vulnerabilities:
  • CVE-2020-27748: local file inclusion vulnerability
  • CVE-2022-4055: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments
Record
CLSA-2025-1751913634
Updated
2026-11-02
OSVCLSA-2026-1791563013 No score

Fix CVE(s): CVE-2022-4055

  • SECURITY UPDATE: -compose argument injection in run_thunderbird()
    • debian/patches/CVE-2022-4055.patch: strip ' from to=/cc=/bcc=/attach= and escape , ' and " in subject=/body= in scripts/xdg-email.in
    • CVE-2022-4055
Record
CLSA-2026-1791563013
Updated
2026-11-02
OSVDEBIAN-CVE-2022-4055 No score

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Record
DEBIAN-CVE-2022-4055
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xdg-utils
AlmaLinux:9
 before 1.1.3-13.el9_6
1.1.3-13.el9_6
xdg-utils
Azure Linux:2
 through 1.1.3-7 None known
xdg-utils
Azure Linux:3
 before 1.2.1-3
1.2.1-3
xdg-utils
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1.1.3-11.el9.tuxcare.els1
1.1.3-11.el9.tuxcare.els1
xdg-utils
TuxCare:Ubuntu:18.04
 before 1.1.2-1ubuntu2.5+tuxcare.els1
1.1.2-1ubuntu2.5+tuxcare.els1
xdg-utils
Debian:12
 All versions, plus listed versions
1.1.3-4.11.2.1-11.2.1-2
 None known
xdg-utils
Debian:13
 All versions, plus listed versions
1.2.1-2
 None known
xdg-utils
Debian:14
 All versions, plus listed versions
1.2.1-2
 None known
xdg-utils
Red Hat:enterprise_linux:9::appstream
 before 0:1.1.3-13.el9_6
0:1.1.3-13.el9_6
xdg-utils
Rocky Linux:9
 before 0:1.1.3-13.el9_6
0:1.1.3-13.el9_6
Show 12 moreShow less
Affected packages
PackageAffectedFixed
xdg-utils
Root:Debian:12
 before 1.1.3-4.1.aikido.12
1.1.3-4.1.aikido.121.1.3-4.1.root.io.41.1.3-4.1.root.io.51.1.3-4.1.root.io.71.1.3-4.1.root.io.81.1.3-4.1.root.io.91.1.3-4.1.root.io.101.1.3-4.1.root.io.11.1.3-4.1.root.io.21.1.3-4.1.root.io.31.1.3-4.1.root.io.61.1.3-4.1.root.io.11
rootio-xdg-utils
Root:Debian:12
 before 1.1.3-4.1.aikido.12
1.1.3-4.1.aikido.121.1.3-4.1.root.io.41.1.3-4.1.root.io.51.1.3-4.1.root.io.71.1.3-4.1.root.io.81.1.3-4.1.root.io.91.1.3-4.1.root.io.101.1.3-4.1.root.io.11.1.3-4.1.root.io.21.1.3-4.1.root.io.31.1.3-4.1.root.io.61.1.3-4.1.root.io.11
xdg-utils
Root:Debian:13
 before 1.2.1-2.root.io.1
1.2.1-2.root.io.11.2.1-2.aikido.2
rootio-xdg-utils
Root:Debian:13
 before 1.2.1-2.root.io.1
1.2.1-2.root.io.11.2.1-2.aikido.2
xdg-utils
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.0~rc3+git20150907-1ubuntu21.1.0~rc3+git20150907-1ubuntu31.1.1-1ubuntu11.1.1-1ubuntu1.16.04.11.1.1-1ubuntu1.16.04.31.1.1-1ubuntu1.16.04.41.1.1-1ubuntu1.16.04.5
 None known
xdg-utils
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.1-1ubuntu21.1.1-1ubuntu31.1.2-1ubuntu11.1.2-1ubuntu21.1.2-1ubuntu2.21.1.2-1ubuntu2.31.1.2-1ubuntu2.41.1.2-1ubuntu2.5
 None known
xdg-utils
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.1.3-1ubuntu21.1.3-2ubuntu11.1.3-2ubuntu1.20.04.11.1.3-2ubuntu1.20.04.2
 None known
xdg-utils
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.1.3-2ubuntu21.1.3-4.1ubuntu11.1.3-4.1ubuntu1.22.04.11.1.3-4.1ubuntu3~22.04.1
 None known
xdg-utils
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.1.3-4.1ubuntu3
 None known
xdg-utils
Ubuntu:25.10
 All versions, plus listed versions
1.2.1-2ubuntu1
 None known
xdg-utils
Ubuntu:26.10
 All versions, plus listed versions
1.2.1-2ubuntu2
 None known
xdg-utils
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.2.1-2ubuntu11.2.1-2ubuntu2
 None known

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4055 is a high vulnerability (CVSS 7.4) in Freedesktop Xdg-utils, published November 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in xdg-utils 1.1.3-13.el9_6.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open