CVE-2025-6430Cross-site Scripting in Mozilla Firefox

CWE-79Cross-site Scripting11 documents8 sources
Severity
6.1MEDIUMNVD
EPSS
0.1%
top 72.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJun 24
Latest updateJul 22

Description

When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a ` ` or ` ` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

NVDmozilla/firefox< 128.12.0+1
Debianmozilla/thunderbird< 1:128.12.0esr-1~deb11u1+3

🔴Vulnerability Details

3
GHSA
GHSA-fvqv-c5hj-jcrp: When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a ` ` or ` ` tag,2025-06-26
OSV
CVE-2025-6430: When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a ` ` or ` ` tag,2025-06-24
CVEList
Content-Disposition header ignored when a file is included in an embed or object tag2025-06-24

📋Vendor Advisories

7
Ubuntu
Thunderbird vulnerabilities2025-07-22
Red Hat
firefox: thunderbird: Content-Disposition header ignored when a file is included in an embed or object tag2025-06-24
Debian
CVE-2025-6430: firefox - When a file download is specified via the `Content-Disposition` header, that dir...2025
Mozilla
Mozilla Foundation Security Advisory 2025-54: CVE-2025-6430
Mozilla
Mozilla Foundation Security Advisory 2025-53: CVE-2025-6430
CVE-2025-6430 — Cross-site Scripting in Mozilla Firefox | cvebase