Vulnerability · Published Nov 18, 2022 · Assigned by redhat
CVE-2022-4055
High 7.4
In plain English
A high-severity security flaw in xdg-utils. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.7%top 46.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | xdg-utils | 1.1.3-13.el9_6 | ALSA-2025:7672 |
| Debian:12 | xdg-utils | no fix listed | DEBIAN-CVE-2022-4055 |
| Debian:13 | xdg-utils | no fix listed | DEBIAN-CVE-2022-4055 |
| Debian:14 | xdg-utils | no fix listed | DEBIAN-CVE-2022-4055 |
| Rocky Linux:9 | xdg-utils | 0:1.1.3-13.el9_6 | RLSA-2025:7672 |
| Ubuntu:22.04:LTS | xdg-utils | no fix listed | UBUNTU-CVE-2022-4055 |
| Ubuntu:24.04:LTS | xdg-utils | no fix listed | UBUNTU-CVE-2022-4055 |
| Ubuntu:25.10 | xdg-utils | no fix listed | UBUNTU-CVE-2022-4055 |
| Ubuntu:26.04:LTS | xdg-utils | no fix listed | UBUNTU-CVE-2022-4055 |
| Ubuntu:26.10 | xdg-utils | no fix listed | UBUNTU-CVE-2022-4055 |
Affected products (as reported)
Weakness: CWE-146 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N