This vulnerability (CVE-2025-3033) affects Mozilla Firefox on Windows platforms. It involves the handling of local Windows .url shortcut files, where selecting a malicious shortcut could lead to an unexpected file being uploaded. This behavior is unintended and represents a security risk. The issue was addressed and fixed in Firefox version 137 and Thunderbird version 137. The CVSS 3.1 vector indicates the attack requires local access with low complexity, no privileges, and no user interaction, with high impact on confidentiality and integrity but no impact on availability.

An attacker who can cause a user to select a malicious Windows .url shortcut file locally could trigger the upload of an unexpected file, potentially leading to unauthorized data disclosure or modification. The impact is rated high due to the potential confidentiality and integrity compromise. However, the vulnerability is limited to Firefox on Windows and does not affect other operating systems. No active exploitation has been reported.

This vulnerability has been fixed in Firefox 137 and Thunderbird 137. Users and administrators should update to these versions or later to remediate the issue. Since the vendor advisory confirms the fix is available, applying the official update is the recommended mitigation. No additional actions are required beyond updating.