Thunderbird processes a multipart message containing an attachment with a carefully crafted filename that causes the client to output the /tmp directory listing when the message is forwarded or edited. This presents a clear information exposure flaw, allowing an attacker to read files that the victim can normally access. The underlying weaknesses are directory traversal and lack of validation of attachment names.

The flaw affects Mozilla Thunderbird versions prior to 137.0.2 on Linux and 128.9.2 on Windows. The CPE list indicates that Red Hat Enterprise Linux releases from 8 to 10 are affected because Thunderbird runs on those platforms, but the issue is inherent to the Thunderbird application and not to the OS itself.

The CVSS score of 6.3 reveals a moderate severity, and the EPSS score of <1% signals a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, which further indicates that widespread exploitation is not documented. The most probable attack vector is a remote email sent to a victim that includes a malicious attachment; the victim then forwards or edits the message in Thunderbird, triggering the directory listing disclosure.