Description
A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | xdg-utils | xdg-utils-1.1.0-rc1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xdg-utils | No fix yet | — |
| Debian 13 | xdg-utils | No fix yet | — |
| Debian 12 | xdg-utils | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | xdg-utils | 1.1.3-2ubuntu1.20.04.1 | USN-4649-1 |
| Ubuntu 18.04 LTS | xdg-utils | 1.1.2-1ubuntu2.4 | USN-4649-1 |
| Ubuntu 16.04 LTS | xdg-utils | 1.1.1-1ubuntu1.16.04.4 | USN-4649-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xdg-utils | 1.1.3-12.amzn2023.0.1 | ALAS2023-2023-007 |
| Amazon Linux 2 | xdg-utils | 1.1.0-0.17.20120809git.amzn2.0.1 | ALAS2-2023-2002 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | xdg-utils | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | xdg-utils | No fix yet | — |
Advisories 3
- USN-4649-1 xdg-utils vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- ALAS2-2023-2002 Moderate: xdg-utils security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 21, 2023
- ALAS2023-2023-007 Moderate: xdg-utils security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 23, 2023