CVE-2022-4055: freedesktop xdg-utils
Vulnerability summary
CVE-2022-4055 is a high (CVSS 7.4) vulnerability in freedesktop xdg-utils. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 18-11-2022PublishedVulnerability first disclosed.
- 29-04-2025Last modifiedVulnerability information updated.
Description
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · Red hatEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- NVDNIST7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
EPSS trend
Probability
0.68%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
-0.01 pp
From 0.68% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.freedesktop.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- xdg-utilsAll versions (No fix recorded)
Freedesktop1 product
- xdg-utils≥ 1.1.0, ≤ 1.1.3
Redhat1 product
- xdg-utils< 0:1.1.3-13.el9_6
Ubuntu1 product
- xdg-utilsAll versions (No fix recorded)
4 vendors · 4 products
