Threats Tagged 'ghsa-85jm-cwp2-mvpv'

CefSharp.Common's FolderSchemeHandlerFactory contains a path validation flaw that allows serving files outside the configured root folder. The vulnerability arises because the code uses a raw string prefix check to validate paths, which does not enforce directory boundaries. This can allow an attacker to access sibling directories with paths that start with the root folder path string but are not actually contained within it. This issue affects versions prior to 148.0.90. Exploitation requires the attacker to induce the embedded browser to request URLs handled by the vulnerable scheme handler.