🔐 CVE Alert

CVE-2023-23598

UNKNOWN 0.0

Arbitrary file read from GTK drag and drop on Linux

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to `DataTransfer.setData`. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

Vendor mozilla
Product firefox
Ecosystems
Industries
Technology
Published Jun 2, 2023
Last Updated Dec 18, 2025
Stay Ahead of the Next One

Get instant alerts for mozilla firefox

Be the first to know when new unknown vulnerabilities affecting mozilla firefox are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Mozilla / Firefox
unspecified < 109
Mozilla / Firefox ESR
unspecified < 102.7
Mozilla / Thunderbird
unspecified < 102.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗
bugzilla.mozilla.org: https://bugzilla.mozilla.org/show_bug.cgi?id=1800425 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2023-01/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2023-02/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2023-03/

Credits

Tom Schuster