The FolderSchemeHandlerFactory component in CefSharp.Common intended to restrict file serving to a configured root folder uses a path validation method that checks if the requested file path starts with the root folder path as a string prefix. This approach fails to enforce directory boundaries, allowing requests to escape to sibling directories whose paths share the root folder prefix string. For example, a request to a path like '../www2/secret.txt' can be combined and canonicalized to a sibling directory outside the root folder but still pass the prefix check, resulting in unauthorized file exposure. This vulnerability affects versions before 148.0.90 and is tracked as CVE-2026-48796.

Applications using FolderSchemeHandlerFactory to serve files may unintentionally expose local files outside the intended root directory, potentially leaking sensitive data stored in sibling directories. The vulnerability does not allow modification or deletion of files, only unauthorized read access. Exploitation requires the attacker to cause the embedded browser to request URLs handled by the affected scheme, limiting the attack surface to applications embedding CefSharp with this configuration.

No official patch link is provided in the data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using FolderSchemeHandlerFactory with root folders that have sensitive sibling directories sharing the same path prefix. Validate and sanitize requested paths to ensure they do not escape the intended root directory. Monitor vendor communications for an official fix or update.