CVE-2026-48796: CefSharp Path Traversal Vulnerability

CVE-2026-48796 Overview

CVE-2026-48796 is a path traversal vulnerability [CWE-22] in CefSharp, the .NET bindings for the Chromium Embedded Framework used by Windows Forms and Windows Presentation Foundation applications. The flaw lives in CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs, which used a raw string prefix check to confine requests inside a configured root directory. Attackers can craft URLs such as ..%2fwww2/secret.txt to escape a www directory into a sibling www2 directory that shares the same string prefix. Applications registering FolderSchemeHandlerFactory for a custom, HTTP, or HTTPS scheme can then serve local files outside the intended root. The issue is fixed in version 148.0.90.

Critical Impact
Embedded browsers in CefSharp applications can be tricked into serving arbitrary local files from directories that share a name prefix with the configured root, exposing sensitive data on Windows and Unix-style paths.

Affected Products

CefSharp versions prior to 148.0.90
Windows Forms applications embedding CefSharp with FolderSchemeHandlerFactory registered
Windows Presentation Foundation (WPF) applications embedding CefSharp with FolderSchemeHandlerFactory registered

Discovery Timeline

2026-08-18 - CVE-2026-48796 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-48796

Vulnerability Analysis

The vulnerability arises from an insufficient directory boundary check in FolderSchemeHandlerFactory. The handler decodes and canonicalizes a request path, then compares it to the configured rootFolder using filePath.StartsWith(rootFolder, StringComparison.OrdinalIgnoreCase). This prefix comparison does not require a directory separator between rootFolder and the remainder of the path. As a result, any sibling directory whose name begins with the same characters as rootFolder passes the check. The condition affects both Unix-style paths such as /tmp/app/www2 and Windows paths such as C:\app\www2.

Root Cause

The root cause is a missing directory boundary in the containment check. StartsWith treats rootFolder as an arbitrary string, not as a hierarchical path component. When rootFolder is C:\app\www, the string C:\app\www2\secret.txt satisfies StartsWith even though it points to a sibling directory outside the intended root.

Attack Vector

An attacker who can influence a URL loaded by the embedded browser supplies an encoded traversal segment such as ..%2fwww2/secret.txt. After URL decoding and path canonicalization, the resolved file path escapes the configured root while still matching the prefix comparison. The handler then reads and returns file contents from the sibling directory. User interaction is required, since the embedded browser must be induced to request the crafted URL.

text

             {
                 throw new DirectoryNotFoundException(this.rootFolder);
             }
+
+            this.rootFolder = this.rootFolder.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar) + Path.DirectorySeparatorChar;
         }
 
         /// <summary>

Source: GitHub Commit 3475c7e. The patch appends a trailing directory separator to the normalized root before comparison, enforcing a directory boundary. The fix also rejects null bytes and alternate data stream syntax.

Detection Methods for CVE-2026-48796

Indicators of Compromise

Requests to custom, HTTP, or HTTPS schemes containing encoded traversal sequences such as ..%2f, ..%5c, or literal ..\ and ../ targeting sibling directory names.
Access log entries in embedded browser telemetry referencing filenames outside the registered www root, particularly siblings that share the root's name prefix.
Application file reads to paths matching <rootFolder><suffix>\ where <suffix> extends the root name into a sibling directory.

Detection Strategies

Inspect CefSharp scheme handler request URIs for path traversal tokens and reject or alert on decoded paths that resolve outside the intended root.
Correlate process file-open events from the host application with the URL requested by the embedded browser to identify off-root file access.
Audit application binaries for use of FolderSchemeHandlerFactory from CefSharp versions earlier than 148.0.90.

Monitoring Recommendations

Log all requests handled by FolderSchemeHandlerFactory including the raw and canonicalized paths for offline review.
Monitor endpoint file access events for reads of sensitive files by processes hosting CefSharp when those files sit outside the documented content directory.
Track outbound rendering of unexpected file types (configuration files, credentials, source) inside embedded browser sessions.

How to Mitigate CVE-2026-48796

Immediate Actions Required

Upgrade CefSharp to version 148.0.90 or later in all Windows Forms and WPF applications that embed the framework.
Inventory internally developed and third-party applications for use of FolderSchemeHandlerFactory and prioritize those exposing HTTP or HTTPS schemes.
Restrict which URLs the embedded browser can navigate to, blocking user-controlled or remote content from reaching registered folder schemes.

Patch Information

The fix is delivered in CefSharp release v148.0.90. The patched FolderSchemeHandlerFactory normalizes rootFolder with a trailing directory separator before performing the containment check, and rejects null bytes and alternate data stream syntax. Full technical detail is available in GitHub Security Advisory GHSA-85jm-cwp2-mvpv.

Workarounds

Rename the configured root directory so no sibling directory shares its name as a prefix (for example, rename www to www_root).
Replace FolderSchemeHandlerFactory with a custom scheme handler that validates the canonical path is a child of the root using a directory-boundary check.
Filter incoming request URLs at the scheme handler entry point to reject any decoded path containing .., null bytes, or : alternate data stream markers.

bash

# Update CefSharp NuGet package to the patched release
dotnet add package CefSharp.WinForms --version 148.0.90
dotnet add package CefSharp.Wpf --version 148.0.90
dotnet add package CefSharp.Common --version 148.0.90