CVE-2021-23956: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox < 85.

Affected products

• Mozilla Firefox: before 85.0 (fixed in 85.0)

Published 2021-02-26. Last modified 2026-06-17.