CVE-2026-48796

Received Received - Intake

Path Traversal in CefSharp FolderSchemeHandler

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWith(rootFolder, StringComparison.OrdinalIgnoreCase) to decide whether a decoded and canonicalized request path remained inside rootFolder. That raw prefix test did not enforce a directory boundary, so a request such as ..%2fwww2/secret.txt could escape a configured www directory into a sibling www2 directory whose path shared the same string prefix. Applications that register FolderSchemeHandlerFactory for a custom scheme or an HTTP or HTTPS scheme can therefore serve local files outside the intended root when an attacker can cause the embedded browser to request the crafted URL. The issue affects both Unix-style paths such as /tmp/app/www2 and Windows paths such as C:\app\www2, and the fix appends a directory separator to the normalized root before comparison while rejecting null bytes and alternate data stream syntax. This issue is fixed in version 148.0.90.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-48796

Affected Vendors & Products

Vendor	Product	Version / Range
cefsharp	cefsharp	148.0.90

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-48796 is a path traversal vulnerability in CefSharp, a .NET library for embedding Chromium in Windows apps. It allows attackers to bypass directory restrictions by using crafted URLs like ..%2fwww2/secret.txt to access files outside the intended root folder. The issue occurs because the code checks if a path starts with a root folder but doesn't enforce directory boundaries.

Detection Guidance

Detecting this vulnerability requires checking if your application uses CefSharp versions prior to 148.0.90 and if it registers FolderSchemeHandlerFactory for custom or HTTP/HTTPS schemes. Review application logs for requests containing patterns like ..%2f or directory traversal attempts. No specific commands are provided in the context.

Impact Analysis

If you use an affected version of CefSharp in your application, attackers could trick your embedded browser into loading sensitive files from outside the intended directory. This could expose local files, configuration data, or other confidential information stored on the system.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR or HIPAA by allowing unauthorized access to sensitive files outside an intended directory. If an attacker exploits this flaw to access restricted files, it may lead to data breaches or unauthorized disclosure of personal or health information, depending on the application's use case.

Mitigation Strategies

Upgrade CefSharp to version 148.0.90 or later. If upgrading is not immediately possible, disable FolderSchemeHandlerFactory for custom or HTTP/HTTPS schemes or restrict user input to prevent crafted URLs. Validate all file paths to ensure they remain within intended directories.

Hi! I’m here to help you understand CVE-2026-48796. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70