ghsa-85jm-cwp2-mvpv
CVSS 5.3 osv_nuget### Summary `FolderSchemeHandlerFactory` was intended to restrict served files to a configured `rootFolder`, but its path validation used a raw string prefix check. A request could escape to a sibling directory whose full path starts with the root folder path, allowing files outside the configured root to be served. ### Details In affected versions, `FolderSchemeHandlerFactory` canonicalized `rootFolder`, decoded the request path, combined it with the root, and then allowed the file when: ```csharp filePath.StartsWith(rootFolder, StringComparison.OrdinalIgnoreCase) ``` This does not enforce a directory boundary. For example, `/tmp/app/www2/secret.txt` starts with `/tmp/app/www`, but `www2` is a sibling of `www`, not a child. The same issue applies on Windows, for example `C:\app\www2\secret.txt` starts with `C:\app\www`. The affected code was reviewed at commit `b5fef3bb4bc58798c95170078c41de92cfe9066e`, assembly version `147.0.100`. ### PoC Set `rootFolder` to a directory named `www` and create a sibling directory named `www2`: ```text <temp>/www/index.html <temp>/www2/secret.txt ``` Register `FolderSchemeHandlerFactory` for `<temp>/www`, then request: ```text https://folderschemehandlerfactory.test/..%2fwww2/secret.txt ``` The request path is URL-decoded to `../www2/secret.txt`, combined with `<temp>/www`, and canonicalized to: ```text <temp>/www2/secret.txt ``` Because `<temp>/www2/secret.txt` starts with `<temp>/www` as a string prefix, the affected check passes and `secret.txt` is served from outside `rootFolder`. Expected vulnerable result: HTTP 200 with the contents of `<temp>/www2/secret.txt`. Expected fixed result: 404 or equivalent not-found response because the resolved file is outside `rootFolder`. ### Impact Applications using `FolderSchemeHandlerFactory` for a custom scheme or registered HTTP/HTTPS scheme may expose local files outside the intended served directory. This is most relevant when sensitive sibling directories share the root path prefix, such as `www`/`www2`, `public`/`public_backup`, or `static`/`static-secrets`. An attacker must be able to cause the embedded browser to request URLs handled by the affected scheme registration.
- Published
- unknown
- Last Modified
- unknown
CVSS details not available.
No product information available.
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-85jm-cwp2-mvpv/GHSA-85jm-cwp2-mvpv.json"
},
"package": {
"ecosystem": "NuGet",
"name": "CefSharp.Common",
"purl": "pkg:nuget/CefSharp.Common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "148.0.90"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"100.0.120-pre",
"100.0.140",
"100.0.230",
"101.0.150",
"101.0.180",
"102.0.100",
"102.0.90",
"103.0.120",
"103.0.80",
"103.0.90",
"104.4.180",
"104.4.240",
"105.3.330",
"105.3.390",
"106.0.260",
"106.0.290",
"107.1.120",
"107.1.40",
"107.1.50",
"107.1.90",
"108.4.130",
"109.1.110",
"110.0.250",
"110.0.280",
"110.0.300",
"111.2.20",
"111.2.70",
"112.2.70",
"112.3.0",
"113.1.40",
"113.3.50",
"114.2.100",
"114.2.120",
"115.3.110",
"115.3.130",
"116.0.130",
"116.0.150",
"116.0.190",
"116.0.230",
"117.2.20",
"117.2.40",
"118.6.80",
"119.1.20",
"119.4.30",
"120.1.110",
"120.1.80",
"120.2.50",
"120.2.70",
"121.3.130",
"121.3.70",
"122.1.120",
"123.0.60",
"124.3.20",
"124.3.50",
"124.3.80",
"125.0.210",
"126.2.180",
"126.2.70",
"127.3.50",
"128.4.90",
"129.0.110",
"130.1.90",
"131.2.70",
"131.3.10",
"131.3.50",
"132.3.11",
"133.4.21",
"134.3.60",
"134.3.90",
"135.0.170",
"135.0.220",
"136.1.40",
"137.0.100",
"138.0.170",
"138.0.340",
"139.0.280",
"140.1.140",
"141.0.110",
"143.0.90",
"144.0.120",
"144.0.250",
"144.0.260",
"144.0.270",
"144.0.300",
"145.0.260",
"146.0.100",
"146.0.70",
"147.0.100",
"31.0.0-pre1",
"33.0.0",
"33.0.2",
"33.1.0-pre01",
"37.0.0",
"37.0.0-pre01",
"37.0.0-pre02",
"37.0.1",
"37.0.2",
"37.0.3",
"39.0.0",
"39.0.0-pre01",
"39.0.0-pre02",
"39.0.0-pre03",
"39.0.1",
"39.0.2",
"41.0.0",
"41.0.0-pre01",
"41.0.1",
"43.0.0",
"43.0.0-pre01",
"43.0.0-pre02",
"43.0.1",
"45.0.0",
"45.0.0-pre01",
"47.0.0",
"47.0.0-pre01",
"47.0.1",
"47.0.2",
"47.0.3",
"47.0.4",
"49.0.0",
"49.0.0-pre01",
"49.0.0-pre02",
"49.0.1",
"51.0.0",
"51.0.0-pre01",
"51.0.0-pre02",
"53.0.0",
"53.0.0-pre01",
"53.0.1",
"55.0.0",
"55.0.0-pre01",
"57.0.0",
"57.0.0-pre01",
"62.0.0-pre01",
"62.0.0-proprietary-codecs",
"62.0.0-proprietary-codecs2",
"63.0.0",
"63.0.0-pre01",
"63.0.0-pre02",
"63.0.0-pre03",
"63.0.1",
"63.0.2",
"63.0.3",
"65.0.0",
"65.0.0-pre01",
"65.0.0-pre02",
"65.0.1",
"67.0.0",
"67.0.0-pre01",
"69.0.0",
"69.0.0-pre01",
"71.0.0",
"71.0.0-pre01",
"71.0.1",
"71.0.2",
"73.1.120-pre01",
"73.1.130",
"75.1.140-pre01",
"75.1.141",
"75.1.142",
"75.1.143",
"79.1.310-pre",
"79.1.350",
"79.1.360",
"81.3.100",
"81.3.20-pre",
"83.3.120-pre",
"83.4.20",
"84.3.10-pre",
"84.4.10",
"85.3.120-pre",
"85.3.121",
"85.3.121-pre",
"85.3.130",
"86.0.240-pre",
"86.0.241",
"87.1.130-pre",
"87.1.131-pre",
"87.1.132",
"88.2.40-pre",
"88.2.90",
"89.0.140-pre",
"89.0.170",
"90.5.70-pre",
"90.6.50",
"90.6.70",
"91.1.160",
"91.1.210",
"91.1.211",
"91.1.230",
"91.1.60-pre",
"92.0.250-pre",
"92.0.251",
"92.0.260",
"93.1.110-pre",
"93.1.111",
"93.1.140",
"94.3.0-pre",
"94.4.110",
"94.4.20",
"94.4.50",
"95.7.140-pre",
"95.7.141",
"96.0.140-pre",
"96.0.141",
"96.0.142",
"96.0.170",
"96.0.180",
"97.1.10-pre",
"97.1.11",
"97.1.12",
"97.1.60",
"97.1.61",
"98.1.190",
"98.1.210",
"99.2.120",
"99.2.140",
"99.2.90"
]
}
],
"aliases": [
"CVE-2026-48796"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-30T18:36:12Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\n`FolderSchemeHandlerFactory` was intended to restrict served files to a configured `rootFolder`, but its path validation used a raw string prefix check. A request could escape to a sibling directory whose full path starts with the root folder path, allowing files outside the configured root to be served.\n\n### Details\n\nIn affected versions, `FolderSchemeHandlerFactory` canonicalized `rootFolder`, decoded the request path, combined it with the root, and then allowed the file when:\n\n```csharp\nfilePath.StartsWith(rootFolder, StringComparison.OrdinalIgnoreCase)\n```\n\nThis does not enforce a directory boundary. For example, `/tmp/app/www2/secret.txt` starts with `/tmp/app/www`, but `www2` is a sibling of `www`, not a child. The same issue applies on Windows, for example `C:\\app\\www2\\secret.txt` starts with `C:\\app\\www`.\n\nThe affected code was reviewed at commit `b5fef3bb4bc58798c95170078c41de92cfe9066e`, assembly version `147.0.100`.\n\n### PoC\n\nSet `rootFolder` to a directory named `www` and create a sibling directory named `www2`:\n\n```text\n<temp>/www/index.html\n<temp>/www2/secret.txt\n```\n\nRegister `FolderSchemeHandlerFactory` for `<temp>/www`, then request:\n\n```text\nhttps://folderschemehandlerfactory.test/..%2fwww2/secret.txt\n```\n\nThe request path is URL-decoded to `../www2/secret.txt`, combined with `<temp>/www`, and canonicalized to:\n\n```text\n<temp>/www2/secret.txt\n```\n\nBecause `<temp>/www2/secret.txt` starts with `<temp>/www` as a string prefix, the affected check passes and `secret.txt` is served from outside `rootFolder`.\n\nExpected vulnerable result: HTTP 200 with the contents of `<temp>/www2/secret.txt`.\n\nExpected fixed result: 404 or equivalent not-found response because the resolved file is outside `rootFolder`.\n\n### Impact\n\nApplications using `FolderSchemeHandlerFactory` for a custom scheme or registered HTTP/HTTPS scheme may expose local files outside the intended served directory. This is most relevant when sensitive sibling directories share the root path prefix, such as `www`/`www2`, `public`/`public_backup`, or `static`/`static-secrets`.\n\nAn attacker must be able to cause the embedded browser to request URLs handled by the affected scheme registration.",
"id": "GHSA-85jm-cwp2-mvpv",
"modified": "2026-09-10T03:51:08.931531682Z",
"published": "2026-06-30T18:36:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cefsharp/CefSharp/security/advisories/GHSA-85jm-cwp2-mvpv"
},
{
"type": "PACKAGE",
"url": "https://github.com/cefsharp/CefSharp"
}
],
"schema_version": "1.9.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder"
}