VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jun 24, 2025· Updated Apr 13, 2026

CVE-2025-6430

CVE-2025-6430

Description

When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a <embed> or <object> tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Firefox and Thunderbird ignore Content-Disposition: attachment when loading files via or , enabling XSS attacks.

Vulnerability

Overview

CVE-2025-6430 describes a flaw in Firefox and Thunderbird where the Content-Disposition: attachment HTTP header is ignored when a file is loaded via ` or ` tags. Normally, this header forces the browser to download the file rather than display it inline, serving as a critical defense against cross-site scripting (XSS) when user-uploaded content is served. However, due to this bug, the header is bypassed, and the file is rendered directly in the browser context [1].

Exploitation

An attacker can exploit this by uploading a malicious HTML, XML, or SVG file to a website that returns it with Content-Disposition: attachment. If the attacker then tricks a victim into visiting a page that embeds that file via ` or `, the browser will ignore the download directive and render the file, executing any embedded scripts in the origin of the vulnerable site. No special privileges are required beyond the ability to host or reference the uploaded file [1].

Impact

Successful exploitation leads to cross-site scripting (XSS) in the context of the vulnerable website, potentially allowing an attacker to steal cookies, session tokens, or perform actions on behalf of the victim. The vulnerability is rated Medium severity with a CVSS v3 score of 6.1 [2].

Mitigation

Mozilla has addressed this issue in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. Users are strongly advised to update their browsers to the latest versions to prevent exploitation [2][3][4].

References
  1. 1971140 - (CVE-2025-6430) Ignoring of a Content-Disposition: attachments header leads to XSS flaws
  2. Security Vulnerabilities fixed in Firefox 140
  3. Security Vulnerabilities fixed in Thunderbird 140
  4. Security Vulnerabilities fixed in Thunderbird 128.12

AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

79

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.