{"id":"CVE-2026-48796","aliases":["GHSA-85jm-cwp2-mvpv"],"url":"https://o3.security/vulnerability/CVE-2026-48796","summary":"CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder","details":"### Summary\n\n`FolderSchemeHandlerFactory` was intended to restrict served files to a configured `rootFolder`, but its path validation used a raw string prefix check. A request could escape to a sibling directory whose full path starts with the root folder path, allowing files outside the configured root to be served.\n\n### Details\n\nIn affected versions, `FolderSchemeHandlerFactory` canonicalized `rootFolder`, decoded the request path, combined it with the root, and then allowed the file when:\n\n```csharp\nfilePath.StartsWith(rootFolder, StringComparison.OrdinalIgnoreCase)\n```\n\nThis does not enforce a directory boundary. For example, `/tmp/app/www2/secret.txt` starts with `/tmp/app/www`, but `www2` is a sibling of `www`, not a child. The same issue applies on Windows, for example `C:\\app\\www2\\secret.txt` starts with `C:\\app\\www`.\n\nThe affected code was reviewed at commit `b5fef3bb4bc58798c95170078c41de92cfe9066e`, assembly version `147.0.100`.\n\n### PoC\n\nSet `rootFolder` to a directory named `www` and create a sibling directory named `www2`:\n\n```text\n<temp>/www/index.html\n<temp>/www2/secret.txt\n```\n\nRegister `FolderSchemeHandlerFactory` for `<temp>/www`, then request:\n\n```text\nhttps://folderschemehandlerfactory.test/..%2fwww2/secret.txt\n```\n\nThe request path is URL-decoded to `../www2/secret.txt`, combined with `<temp>/www`, and canonicalized to:\n\n```text\n<temp>/www2/secret.txt\n```\n\nBecause `<temp>/www2/secret.txt` starts with `<temp>/www` as a string prefix, the affected check passes and `secret.txt` is served from outside `rootFolder`.\n\nExpected vulnerable result: HTTP 200 with the contents of `<temp>/www2/secret.txt`.\n\nExpected fixed result: 404 or equivalent not-found response because the resolved file is outside `rootFolder`.\n\n### Impact\n\nApplications using `FolderSchemeHandlerFactory` for a custom scheme or registered HTTP/HTTPS scheme may expose local files outside the intended served directory. This is most relevant when sensitive sibling directories share the root path prefix, such as `www`/`www2`, `public`/`public_backup`, or `static`/`static-secrets`.\n\nAn attacker must be able to cause the embedded browser to request URLs handled by the affected scheme registration.","published":"2026-08-18T21:17:16.861Z","modified":"2026-10-21T02:58:21.164581556Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"},"epss":{"score":0.00293,"percentile":0.21897,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"CefSharp.Common","fixedVersion":"148.0.90"}],"fix":{"url":"https://github.com/cefsharp/CefSharp/commit/3475c7ef14119f67ec3720866bb3e4b1c6c68632","label":"cefsharp/CefSharp@3475c7e"},"references":[{"type":"WEB","url":"https://github.com/cefsharp/CefSharp/releases/tag/v148.0.90"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48796.json"},{"type":"ADVISORY","url":"https://github.com/cefsharp/CefSharp/security/advisories/GHSA-85jm-cwp2-mvpv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48796"},{"type":"FIX","url":"https://github.com/cefsharp/CefSharp/commit/3475c7ef14119f67ec3720866bb3e4b1c6c68632"},{"type":"PACKAGE","url":"https://github.com/cefsharp/CefSharp"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:21.164581556Z"}}