CVE-2026-48796

Name of the Vulnerable Software and Affected Versions CefSharp versions prior to 148.0.90

Description CefSharp provides .NET bindings for the Chromium Embedded Framework. The FolderSchemeHandlerFactory class fails to properly enforce directory boundaries when validating if a decoded and canonicalized request path remains within the configured rootFolder. The validation relies on a raw string prefix check using filePath.StartsWith(rootFolder, StringComparison.OrdinalIgnoreCase), which allows requests to escape the intended directory and access sibling directories that share the same string prefix. For example, a request for ..%2fwww2/secret.txt could access a www2 directory when the root is set to www. This issue affects both Unix-style and Windows paths and can lead to the exposure of local files outside the intended root when an attacker can cause the embedded browser to request a crafted URL.

Recommendations Update CefSharp to version 148.0.90.