CVE-2023-28163: mozilla firefox Path Traversal
Vulnerability summary
CVE-2023-28163 is a medium (CVSS 6.5) Path Traversal vulnerability in mozilla firefox. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 02-06-2023PublishedVulnerability first disclosed.
- 09-01-2025Last modifiedVulnerability information updated.
Description
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.80% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla3 products
- firefox≥ unspecified, < 111 | < 111.0
- firefox_esr≥ unspecified, < 102.9 | < 102.9
- thunderbird≥ unspecified, < 102.9 | < 102.9
Ubuntu1 product
- thunderbirdAll versions (No fix recorded)
2 vendors · 4 products
References
8 links- www.mozilla.org/security/advisories/mfsa2023-09/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2023-10/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2023-11/Vendor Advisory