Read the docs
TI-2023-12732 Aliases CVE-2023-28163GHSA-xwh8-4fp4-mvqf

Path traversal in Mozilla Firefox

Priority MEDIUM 62CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00798 56th percentileScored 2026-11-07
Fix Fixed Firefox (Mozilla): 111Firefox ESR (Mozilla): 102.9+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MozillaFirefoxbefore 111111Patch availableCNA
MozillaFirefox ESRbefore 102.9102.9Patch availableCNA
MozillaThunderbirdbefore 102.9102.9Patch availableCNA
  • Firefox VendorMozilla Affected before 111 Fixed in 111 Patch available CNA
  • Firefox ESR VendorMozilla Affected before 102.9 Fixed in 102.9 Patch available CNA
  • Thunderbird VendorMozilla Affected before 102.9 Fixed in 102.9 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*before 111.0VulnerableMozilla
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*before 102.9VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*before 102.9VulnerableMozilla
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions before 111.0 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* Versions before 102.9 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 102.9 Vulnerable ·Mozilla

Remediation

  • Fix · CNA Firefox (Mozilla) Fixed in 111
  • Fix · CNA Firefox ESR (Mozilla) Fixed in 102.9
  • Fix · CNA Thunderbird (Mozilla) Fixed in 102.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Mozilla Firefox 111

    13 records Highest priority Priority HIGH 2 HIGH, 9 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2023-12731 Type confusion in Mozilla FirefoxPriority HIGH 73
    • TI-2023-12730 If temporary "one-time" permissions, such as the ability to use the Camera, were granted…Priority HIGH 73
    • TI-2023-12733 Origin validation error in Mozilla FirefoxPriority MEDIUM 62
    Show all 13 records →
  • Release ·

    Mozilla Firefox ESR, Thunderbird 102.9

    6 records Highest priority Priority HIGH 1 HIGH, 4 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2023-12731 Type confusion in Mozilla FirefoxPriority HIGH 73
    • TI-2023-12733 Origin validation error in Mozilla FirefoxPriority MEDIUM 62
    • TI-2023-11023 Sometimes, when invalidating JIT code while following an iterator, the newly generated…Priority MEDIUM 62
    Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28163
  2. 2026-10-03 Alias added: GHSA-xwh8-4fp4-mvqf

References

Advisory 4

  • TI-2024-08981 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
  • TI-2019-08769 Improper input validation in Mozilla Firefox ESR KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-03577 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 3444 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences