Directory Traversal Vulnerability in CefSharp for Windows Forms and WPF Applications

CVE-2026-48796

What is CVE-2026-48796?

CefSharp, which provides .NET bindings for the Chromium Embedded Framework in Windows Forms and Windows Presentation Foundation applications, has a directory traversal vulnerability that can be exploited by attackers. Prior to version 148.0.90, the FolderSchemeHandlerFactory used an insufficient raw prefix test to determine the validity of request paths against a configured root directory. This vulnerability allows crafted URLs like '..%2fwww2/secret.txt' to bypass boundaries and access files outside the intended directory, exposing sensitive information. The vulnerability is addressed in version 148.0.90, which enforces strict directory boundaries by appending a directory separator and rejecting malicious input.

References