CVE-2026-48796 is a medium-severity path traversal vulnerability in CefSharp.Common (nuget), affecting versions < 148.0.90. It is fixed in 148.0.90.
Summary FolderSchemeHandlerFactory was intended to restrict served files to a configured rootFolder, but its path validation used a raw string prefix check. A request could escape to a sibling directory whose full path starts with the root folder path, allowing files outside the configured root to be served. Details In affected versions, FolderSchemeHandlerFactory canonicalized rootFolder, decoded the request path, combined it with the root, and then allowed the file when: This does not enforce a directory boundary. For example, /tmp/app/www2/secret.txt starts with /tmp/app/www, but www2 is a sibling of www, not a child. The same issue applies on Windows, for example C:\app\www2\secret.txt starts with C:\app\www. The affected code was reviewed at commit b5fef3bb4bc58798c95170078c41de92cfe9066e, assembly version 147.0.100. PoC Set rootFolder to a directory named www and create a sibling directory named www2: Register FolderSchemeHandlerFactory for <temp>/www, then request: The request path is URL-decoded to ../www2/secret.txt, combined with <temp>/www, and canonicalized to: Because <temp>/www2/secret.txt starts with <temp>/www as a string prefix, the affected check passes and secret.txt is served from outside rootFolder. Expected vulnerable result: HTTP 200 with the contents of <temp>/www2/secret.txt. Expected fixed result: 404 or equivalent not-found response because the resolved file is outside rootFolder. Impact Applications using FolderSchemeHandlerFactory for a custom scheme or registered HTTP/HTTPS scheme may expose local files outside the intended served directory. This is most relevant when sensitive sibling directories share the root path prefix, such as www/www2, public/public_backup, or static/static-secrets. An attacker must be able to cause the embedded browser to request URLs handled by the affected scheme registration.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
CVE-2026-48796 has a CVSS score of 5.3 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (148.0.90). Upgrading removes the vulnerable code path.
nuget
CefSharp.Common (< 148.0.90)CefSharp.Common → 148.0.90 (nuget)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether CVE-2026-48796 is reachable in your applications. Explore open-source security for your team.
See if CVE-2026-48796 is reachable in your applications. Get a demo
Already deployed Kodem? See CVE-2026-48796 in your environment →Upgrade CefSharp.Common to 148.0.90 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2026-48796 is a medium-severity path traversal vulnerability in CefSharp.Common (nuget), affecting versions < 148.0.90. It is fixed in 148.0.90. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
CVE-2026-48796 has a CVSS score of 5.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
CefSharp.Common (nuget) versions < 148.0.90 is affected.
Yes. CVE-2026-48796 is fixed in 148.0.90. Upgrade to this version or later.
Whether CVE-2026-48796 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade CefSharp.Common to 148.0.90 or later.