CVE-2020-27748

CVE-2020-27748 describes a flaw in the xdg-email component of xdg-utils-1.1.0-rc1 and newer, specifically affecting how it handles mailto: URIs when interacting with Thunderbird. An attacker could craft a malicious URI that, when clicked by a victim, would discreetly attach a sensitive file to a new email draft. If the victim sends this email without noticing the attachment, it could lead to unauthorized disclosure of confidential information. This vulnerability is rated as Medium severity (CVSS 6.5), indicating a network-based attack with low complexity, requiring user interaction (UI:R), and resulting in high confidentiality impact (C:H) without affecting integrity or availability. The flaw resides in xdg-email, not Thunderbird itself. Currently, there is no evidence of active exploitation, nor is exploit code publicly available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting it has not garnered significant attention.