THREATIST.IORead the docs thunderbird security update
Released 2025-04-30 · Red Hat rating Important · View on Red Hat →
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment.
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally.
By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message.