{"id":"CVE-2022-4055","aliases":["ALSA-2025:7672","AZL-11465","AZL-37063","CLSA-2025-1751913634","CLSA-2026-1791563013","DEBIAN-CVE-2022-4055","EUVD-2022-51432","GHSA-p4jr-wm76-h2v3","RHSA-2025:7672","RLSA-2025:7672","ROOT-OS-DEBIAN-12-CVE-2022-4055","ROOT-OS-DEBIAN-13-CVE-2022-4055","UBUNTU-CVE-2022-4055"],"status":"published","title":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can...","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00692,"percentile":0.53151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-146"],"published":"2022-11-18T00:00:00Z","modified":"2026-11-03T06:02:45Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"xdg-utils","fixed_in":["1.1.3-13.el9_6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"xdg-utils","fixed_in":["1.2.1-3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"xdg-utils","fixed_in":["1.1.2-1ubuntu2.5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xdg-utils","fixed_in":["0:1.1.3-13.el9_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"xdg-utils","fixed_in":["0:1.1.3-13.el9_6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"xdg-utils","fixed_in":["1.1.3-4.1.aikido.12","1.1.3-4.1.root.io.4","1.1.3-4.1.root.io.5","1.1.3-4.1.root.io.7","1.1.3-4.1.root.io.8","1.1.3-4.1.root.io.9","1.1.3-4.1.root.io.10","1.1.3-4.1.root.io.1","1.1.3-4.1.root.io.2","1.1.3-4.1.root.io.3","1.1.3-4.1.root.io.6","1.1.3-4.1.root.io.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-xdg-utils","fixed_in":["1.1.3-4.1.aikido.12","1.1.3-4.1.root.io.4","1.1.3-4.1.root.io.5","1.1.3-4.1.root.io.7","1.1.3-4.1.root.io.8","1.1.3-4.1.root.io.9","1.1.3-4.1.root.io.10","1.1.3-4.1.root.io.1","1.1.3-4.1.root.io.2","1.1.3-4.1.root.io.3","1.1.3-4.1.root.io.6","1.1.3-4.1.root.io.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"xdg-utils","fixed_in":["1.2.1-2.root.io.1","1.2.1-2.aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-xdg-utils","fixed_in":["1.2.1-2.root.io.1","1.2.1-2.aikido.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-13.el9_6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.3-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-11.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-1ubuntu2.5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-4.1","1.2.1-1","1.2.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-13.el9_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-13.el9_6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-4.1.aikido.12"},{"fixed":"1.1.3-4.1.root.io.4"},{"fixed":"1.1.3-4.1.root.io.5"},{"fixed":"1.1.3-4.1.root.io.7"},{"fixed":"1.1.3-4.1.root.io.8"},{"fixed":"1.1.3-4.1.root.io.9"},{"fixed":"1.1.3-4.1.root.io.10"},{"fixed":"1.1.3-4.1.root.io.1"},{"fixed":"1.1.3-4.1.root.io.2"},{"fixed":"1.1.3-4.1.root.io.3"},{"fixed":"1.1.3-4.1.root.io.6"},{"fixed":"1.1.3-4.1.root.io.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-4.1.aikido.12"},{"fixed":"1.1.3-4.1.root.io.4"},{"fixed":"1.1.3-4.1.root.io.5"},{"fixed":"1.1.3-4.1.root.io.7"},{"fixed":"1.1.3-4.1.root.io.8"},{"fixed":"1.1.3-4.1.root.io.9"},{"fixed":"1.1.3-4.1.root.io.10"},{"fixed":"1.1.3-4.1.root.io.1"},{"fixed":"1.1.3-4.1.root.io.2"},{"fixed":"1.1.3-4.1.root.io.3"},{"fixed":"1.1.3-4.1.root.io.6"},{"fixed":"1.1.3-4.1.root.io.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2.root.io.1"},{"fixed":"1.2.1-2.aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2.root.io.1"},{"fixed":"1.2.1-2.aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~rc3+git20150907-1ubuntu2","1.1.0~rc3+git20150907-1ubuntu3","1.1.1-1ubuntu1","1.1.1-1ubuntu1.16.04.1","1.1.1-1ubuntu1.16.04.3","1.1.1-1ubuntu1.16.04.4","1.1.1-1ubuntu1.16.04.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-1ubuntu2","1.1.1-1ubuntu3","1.1.2-1ubuntu1","1.1.2-1ubuntu2","1.1.2-1ubuntu2.2","1.1.2-1ubuntu2.3","1.1.2-1ubuntu2.4","1.1.2-1ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-1ubuntu2","1.1.3-2ubuntu1","1.1.3-2ubuntu1.20.04.1","1.1.3-2ubuntu1.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-2ubuntu2","1.1.3-4.1ubuntu1","1.1.3-4.1ubuntu1.22.04.1","1.1.3-4.1ubuntu3~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-4.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xdg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2ubuntu1","1.2.1-2ubuntu2"]}],"products":[{"vendor":"freedesktop","product":"xdg-utils"}],"references":[{"url":"https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/205#note_1494267","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4055","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p4jr-wm76-h2v3"},{"url":"https://access.redhat.com/errata/RHSA-2025:7672","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4055","tags":["report"]},{"url":"https://bugzilla.redhat.com/2143792","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7672.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1751913634.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1791563013.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4055.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-4055","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143792","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7672.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4055","tags":["advisory","report"]},{"url":"https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/205","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7672","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-4055","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","status":"published","published":"2022-11-18T00:00:00Z","modified":"2025-04-29T18:55:59.428Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-146"],"updated_at":"2026-11-02T14:34:37.932195Z"}],"euvd":[{"id":"EUVD-2022-51432","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","status":"published","published":"2022-11-18T00:00:00Z","modified":"2025-04-29T18:55:59Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:00.012701Z"}],"ghsa":[{"id":"GHSA-p4jr-wm76-h2v3","title":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can...","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","status":"published","published":"2022-11-19T00:30:53Z","modified":"2023-01-28T05:06:35Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-146"],"updated_at":"2026-11-02T14:44:26.876971Z"}],"nvd":[{"id":"CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","status":"published","published":"2022-11-19T00:15:31.003Z","modified":"2026-06-17T05:19:51.697Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-146"],"updated_at":"2026-11-02T14:07:32.395456Z"}],"osv":[{"id":"AZL-11465","title":"CVE-2022-4055 affecting package xdg-utils 1.1.3-7","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","status":"published","published":"2022-11-19T00:15:31Z","modified":"2026-04-21T04:22:07.420439Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"AZL-37063","title":"CVE-2022-4055 affecting package xdg-utils for versions less than 1.2.1-3","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","status":"published","published":"2022-11-19T00:15:31Z","modified":"2026-04-21T04:51:56.263142Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","status":"published","published":"2022-11-18T00:00:00Z","modified":"2026-10-28T02:31:09.26345184Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-146"],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"RHSA-2025:7672","title":"Red Hat Security Advisory: xdg-utils security update","status":"published","published":"2025-05-16T10:04:06Z","modified":"2026-03-18T11:37:40.631526Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:7672","title":"Moderate: xdg-utils security update","description":"The xdg-utils package is a set of simple scripts that provide basic desktop integration functions for any Free Desktop.\n\nSecurity Fix(es):\n\n* xdg-utils: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments (CVE-2022-4055)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:39.726113Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2022-4055","title":"CVE-2022-4055 in xdg-utils - Patched by Root","description":"Root has patched CVE-2022-4055 in the xdg-utils package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-26T07:22:07Z","modified":"2026-08-26T09:00:08.73133892Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2022-4055","title":"CVE-2022-4055 in xdg-utils - Patched by Root","description":"Root has patched CVE-2022-4055 in the xdg-utils package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T16:49:06Z","modified":"2026-08-24T18:45:12.530896408Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"UBUNTU-CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","status":"published","published":"2022-11-19T00:15:00Z","modified":"2026-10-17T12:55:59.234147638Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"ALSA-2025:7672","title":"Moderate: xdg-utils security update","description":"The xdg-utils package is a set of simple scripts that provide basic desktop integration functions for any Free Desktop.  \n\nSecurity Fix(es):  \n\n  * xdg-utils: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments (CVE-2022-4055)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-15T00:00:00Z","modified":"2026-10-29T11:32:16.432285002Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"CLSA-2025-1751913634","title":"xdg-utils: Fix of 2 CVEs","description":"- xdg-email: disable special support for Thunderbird\n  to address following vulnerabilities:\n- CVE-2020-27748: local file inclusion vulnerability\n- CVE-2022-4055: improper parse of mailto URIs allows bypass\n  of Thunderbird security mechanism for attachments","status":"published","published":"2025-07-07T18:40:39Z","modified":"2026-06-01T00:31:07.917748068Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1791563013","title":"Fix CVE(s): CVE-2022-4055","description":"   * SECURITY UPDATE: -compose argument injection in run_thunderbird()\n     - debian/patches/CVE-2022-4055.patch: strip ' from to=/cc=/bcc=/attach=\n       and escape , ' and \" in subject=/body= in scripts/xdg-email.in\n     - CVE-2022-4055","status":"published","published":"2026-10-09T16:23:45Z","modified":"2026-10-26T09:32:04.619638185Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"DEBIAN-CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.","status":"published","published":"2022-11-19T00:15:31.003Z","modified":"2026-11-03T06:02:45.952552533Z","updated_at":"2026-11-03T06:43:43.638289Z"}]}}