CVE-2022-31739
Mozilla: Attacker-influenced path traversal when saving downloaded files
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · May 31, 2022
Updated · November 21, 2025
Description
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when downloading files on Windows, the % character was not escaped, which could have led to a download incorrectly saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.
Statement
This bug only affects Firefox for Windows. Other operating systems are unaffected.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')