CVE-2023-37206

What it actually does

Symlink traversal in file upload handling allows crafted archives to reference arbitrary local files, causing the browser to read and transmit their contents during form submission to an attacker-controlled endpoint.

Why it matters to the business

Sensitive user or organizational files can be silently exfiltrated when users interact with malicious upload workflows, resulting in data leakage without requiring elevated privileges.

How an attack unfolds

An attacker prepares a ZIP or similar archive containing symlinks that point to sensitive local paths, hosts a page that triggers an upload of this archive, and lures the victim into completing the upload action; the browser follows the symlinks and submits the referenced file contents to the attacker's site.

How to fix it

Upgrade Mozilla Firefox to version 115 or later. Disable or restrict file-upload features in high-risk browsing contexts until patches are applied. Enforce content-security policies that limit form-action destinations.

How to confirm the fix worked

Confirm Firefox version is 115 or newer via about:support. Test upload of symlink-containing archives in a controlled environment and verify that only the archive itself (not linked targets) is transmitted. Monitor release notes for the specific fix entry.

Typical attack path

1. Craft archive containing symlinks to target files
2. Host malicious page or email lure that initiates file upload
3. Victim opens the page and triggers the upload form
4. Browser resolves symlinks and transmits file contents
5. Attacker receives sensitive data at controlled endpoint

How to detect it

Review browser process creation and file-access logs around the time of suspected upload activity; look for unusual archive handling or access to files outside the upload directory. Correlate with network POST requests to unexpected domains immediately after file-selection dialogs.

What your security team should do

• Prioritize immediate upgrade of all Firefox instances to 115+
• Add browser version checks to endpoint compliance scans
• Educate users on risks of uploading untrusted archives
• Review web applications that accept user-supplied archives for similar symlink handling issues