CVE-2026-48796 cefsharp CVE debrief

Who should care

Developers and administrators of applications using CefSharp FolderSchemeHandlerFactory, especially those serving local files or with exposure to untrusted input, should assess exposure and verify if applications are using version 148.0.90 or later.

Why it matters

This CVE-2026-48796 vulnerability in CefSharp allows attackers to serve local files outside intended directories. Applications using FolderSchemeHandlerFactory are affected. Defenders should assess exposure, verify version usage, and implement compensating controls.

• Serving local files outside intended directories could lead to unauthorized data exposure.
• Attackers could potentially access sensitive files by crafting specific URLs.
• Defenders need to verify if applications are using the fixed version 148.0.90.
• Implementing compensating controls, such as input validation, is necessary.

Technical summary

CefSharp's FolderSchemeHandlerFactory did not properly enforce directory boundaries, allowing a crafted URL to escape the configured root directory. The fix in version 148.0.90 appends a directory separator to the normalized root before comparison, preventing directory traversal attacks. This issue affects applications using FolderSchemeHandlerFactory for custom schemes or HTTP/HTTPS schemes, potentially allowing attackers to serve local files outside the intended root directory. To address this, developers should update to version 148.0.90 or later and review their usage of FolderSchemeHandlerFactory.

Defensive priority

Medium priority for applications using CefSharp FolderSchemeHandlerFactory, especially those serving local files or with exposure to untrusted input.

Recommended defensive actions

• Assess exposure for applications using CefSharp FolderSchemeHandlerFactory, especially those serving local files or with exposure to untrusted input.
• Verify if applications are using version 148.0.90 or later.
• Implement compensating controls, such as validating and sanitizing input URLs.
• Monitor for suspicious requests that could exploit this vulnerability.
• Review the configuration of FolderSchemeHandlerFactory to ensure it is properly set up.
• Track exceptions and retest remediated assets to ensure the vulnerability is fully addressed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 148.0.90. GitHub references offer additional context from the CefSharp project. To verify, defenders should check the version of CefSharp used in their applications and ensure it is 148.0.90 or later. They should also review the configuration of FolderSchemeHandlerFactory and assess exposure to untrusted input. The vulnerability allows attackers to serve local files outside intended directories by crafting specific URLs. Evidence from

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.