CVE-2022-4055
CVE-2022-4055 is a high-severity vulnerability in Freedesktop Xdg-utils with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-146.
Key facts
- Severity: High (CVSS 3.x base score 7.4)
- EPSS exploit prediction: 1% (47th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-146
- Affected product: Freedesktop Xdg-utils
- Published:
- Last modified:
Description
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
Frequently asked questions
- What is CVE-2022-4055?
- When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
- How severe is CVE-2022-4055?
- CVE-2022-4055 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2022-4055 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (47th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-4055?
- CVE-2022-4055 affects Freedesktop Xdg-utils. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-4055?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2022-4055 published?
- CVE-2022-4055 was published on 2022-11-19 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:freedesktop:xdg-utils:*:*:*:*:*:*:*:*
More vulnerabilities in Freedesktop Xdg-utils
- CVE-2015-1877 — High (CVSS 8.8): The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly…
- CVE-2017-18266 — High (CVSS 8.8): The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program…
- CVE-2009-0068 — Medium (CVSS 6.8): Interaction error in xdg-open allows remote attackers to execute arbitrary code by sending a file with a dangerous MIME…
- CVE-2020-27748 — Medium (CVSS 6.5): A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email…
All CVEs affecting Freedesktop Xdg-utils →
Other CWE-146 vulnerabilities
- CVE-2024-20329 — Critical (CVSS 9.9): A vulnerability in the SSH subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated,…
- CVE-2025-53192 — High (CVSS 8.8): ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache…
- CVE-2023-20035 — High (CVSS 7.8): A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute…
- CVE-2024-20470 — High (CVSS 7.2): A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN…
- CVE-2025-20237 — Medium (CVSS 6.0): A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…
- CVE-2026-22266 — Medium (CVSS 4.7): Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a…