{ "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-85jm-cwp2-mvpv/GHSA-85jm-cwp2-mvpv.json" }, "package": { "ecosystem": "NuGet", "name": "CefSharp.Common", "purl": "pkg:nuget/CefSharp.Common" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "148.0.90" } ], "type": "ECOSYSTEM" } ], "versions": [ "100.0.120-pre", "100.0.140", "100.0.230", "101.0.150", "101.0.180", "102.0.100", "102.0.90", "103.0.120", "103.0.80", "103.0.90", "104.4.180", "104.4.240", "105.3.330", "105.3.390", "106.0.260", "106.0.290", "107.1.120", "107.1.40", "107.1.50", "107.1.90", "108.4.130", "109.1.110", "110.0.250", "110.0.280", "110.0.300", "111.2.20", "111.2.70", "112.2.70", "112.3.0", "113.1.40", "113.3.50", "114.2.100", "114.2.120", "115.3.110", "115.3.130", "116.0.130", "116.0.150", "116.0.190", "116.0.230", "117.2.20", "117.2.40", "118.6.80", "119.1.20", "119.4.30", "120.1.110", "120.1.80", "120.2.50", "120.2.70", "121.3.130", "121.3.70", "122.1.120", "123.0.60", "124.3.20", "124.3.50", "124.3.80", "125.0.210", "126.2.180", "126.2.70", "127.3.50", "128.4.90", "129.0.110", "130.1.90", "131.2.70", "131.3.10", "131.3.50", "132.3.11", "133.4.21", "134.3.60", "134.3.90", "135.0.170", "135.0.220", "136.1.40", "137.0.100", "138.0.170", "138.0.340", "139.0.280", "140.1.140", "141.0.110", "143.0.90", "144.0.120", "144.0.250", "144.0.260", "144.0.270", "144.0.300", "145.0.260", "146.0.100", "146.0.70", "147.0.100", "31.0.0-pre1", "33.0.0", "33.0.2", "33.1.0-pre01", "37.0.0", "37.0.0-pre01", "37.0.0-pre02", "37.0.1", "37.0.2", "37.0.3", "39.0.0", "39.0.0-pre01", "39.0.0-pre02", "39.0.0-pre03", "39.0.1", "39.0.2", "41.0.0", "41.0.0-pre01", "41.0.1", "43.0.0", "43.0.0-pre01", "43.0.0-pre02", "43.0.1", "45.0.0", "45.0.0-pre01", "47.0.0", "47.0.0-pre01", "47.0.1", "47.0.2", "47.0.3", "47.0.4", "49.0.0", "49.0.0-pre01", "49.0.0-pre02", "49.0.1", "51.0.0", "51.0.0-pre01", "51.0.0-pre02", "53.0.0", "53.0.0-pre01", "53.0.1", "55.0.0", "55.0.0-pre01", "57.0.0", "57.0.0-pre01", "62.0.0-pre01", "62.0.0-proprietary-codecs", "62.0.0-proprietary-codecs2", "63.0.0", "63.0.0-pre01", "63.0.0-pre02", "63.0.0-pre03", "63.0.1", "63.0.2", "63.0.3", "65.0.0", "65.0.0-pre01", "65.0.0-pre02", "65.0.1", "67.0.0", "67.0.0-pre01", "69.0.0", "69.0.0-pre01", "71.0.0", "71.0.0-pre01", "71.0.1", "71.0.2", "73.1.120-pre01", "73.1.130", "75.1.140-pre01", "75.1.141", "75.1.142", "75.1.143", "79.1.310-pre", "79.1.350", "79.1.360", "81.3.100", "81.3.20-pre", "83.3.120-pre", "83.4.20", "84.3.10-pre", "84.4.10", "85.3.120-pre", "85.3.121", "85.3.121-pre", "85.3.130", "86.0.240-pre", "86.0.241", "87.1.130-pre", "87.1.131-pre", "87.1.132", "88.2.40-pre", "88.2.90", "89.0.140-pre", "89.0.170", "90.5.70-pre", "90.6.50", "90.6.70", "91.1.160", "91.1.210", "91.1.211", "91.1.230", "91.1.60-pre", "92.0.250-pre", "92.0.251", "92.0.260", "93.1.110-pre", "93.1.111", "93.1.140", "94.3.0-pre", "94.4.110", "94.4.20", "94.4.50", "95.7.140-pre", "95.7.141", "96.0.140-pre", "96.0.141", "96.0.142", "96.0.170", "96.0.180", "97.1.10-pre", "97.1.11", "97.1.12", "97.1.60", "97.1.61", "98.1.190", "98.1.210", "99.2.120", "99.2.140", "99.2.90" ] } ], "aliases": [ "CVE-2026-48796" ], "database_specific": { "cwe_ids": [ "CWE-22" ], "github_reviewed": true, "github_reviewed_at": "2026-06-30T18:36:12Z", "nvd_published_at": null, "severity": "MODERATE" }, "details": "### Summary\n\n`FolderSchemeHandlerFactory` was intended to restrict served files to a configured `rootFolder`, but its path validation used a raw string prefix check. A request could escape to a sibling directory whose full path starts with the root folder path, allowing files outside the configured root to be served.\n\n### Details\n\nIn affected versions, `FolderSchemeHandlerFactory` canonicalized `rootFolder`, decoded the request path, combined it with the root, and then allowed the file when:\n\n```csharp\nfilePath.StartsWith(rootFolder, StringComparison.OrdinalIgnoreCase)\n```\n\nThis does not enforce a directory boundary. For example, `/tmp/app/www2/secret.txt` starts with `/tmp/app/www`, but `www2` is a sibling of `www`, not a child. The same issue applies on Windows, for example `C:\\app\\www2\\secret.txt` starts with `C:\\app\\www`.\n\nThe affected code was reviewed at commit `b5fef3bb4bc58798c95170078c41de92cfe9066e`, assembly version `147.0.100`.\n\n### PoC\n\nSet `rootFolder` to a directory named `www` and create a sibling directory named `www2`:\n\n```text\n/www/index.html\n/www2/secret.txt\n```\n\nRegister `FolderSchemeHandlerFactory` for `/www`, then request:\n\n```text\nhttps://folderschemehandlerfactory.test/..%2fwww2/secret.txt\n```\n\nThe request path is URL-decoded to `../www2/secret.txt`, combined with `/www`, and canonicalized to:\n\n```text\n/www2/secret.txt\n```\n\nBecause `/www2/secret.txt` starts with `/www` as a string prefix, the affected check passes and `secret.txt` is served from outside `rootFolder`.\n\nExpected vulnerable result: HTTP 200 with the contents of `/www2/secret.txt`.\n\nExpected fixed result: 404 or equivalent not-found response because the resolved file is outside `rootFolder`.\n\n### Impact\n\nApplications using `FolderSchemeHandlerFactory` for a custom scheme or registered HTTP/HTTPS scheme may expose local files outside the intended served directory. This is most relevant when sensitive sibling directories share the root path prefix, such as `www`/`www2`, `public`/`public_backup`, or `static`/`static-secrets`.\n\nAn attacker must be able to cause the embedded browser to request URLs handled by the affected scheme registration.", "id": "GHSA-85jm-cwp2-mvpv", "modified": "2026-09-10T03:51:08.931531682Z", "published": "2026-06-30T18:36:12Z", "references": [ { "type": "WEB", "url": "https://github.com/cefsharp/CefSharp/security/advisories/GHSA-85jm-cwp2-mvpv" }, { "type": "PACKAGE", "url": "https://github.com/cefsharp/CefSharp" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "type": "CVSS_V3" } ], "summary": "CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder" }