CefSharp's FolderSchemeHandlerFactory performed a simple prefix check to verify that a requested file path remained within a configured root folder. The implementation relied on string.StartsWith on the raw, decoded, and canonicalized path, which failed to enforce a directory boundary. As a result, a crafted request such as ..%2fwww2/secret.txt could escape the intended root and access files in a sibling directory. This flaw allows an attacker who can influence the embedded browser's request URL—whether through a custom scheme or a standard HTTP/HTTPS request—to read or potentially modify local files outside the authorized directory. The vulnerability is a classic path traversal (CWE‑22) that compromises confidentiality and integrity of files located alongside the application.

All applications built with the open-source CefSharp library that register FolderSchemeHandlerFactory for custom schemes, HTTP, or HTTPS prior to version 148.0.90 are vulnerable. This includes any .NET Windows Forms or WPF application that relies on the default folder handler and has not implemented additional path validation. The issue is present in both Unix‑style and Windows‑style file systems, as the check operates on canonicalized paths regardless of OS.

The shared CVSS score of 5.3 indicates a moderate severity; EPSS is not available, so the likelihood of exploitation at this time is unclear. The vulnerability is not currently listed in CISA's KEV catalog. The flaw can be exploited when an attacker can direct the embedded browser to load a crafted URL; if the application accepts user‑controlled inputs for custom scheme URLs, a remote or local attacker could trigger the path traversal. Because the exploit requires only a crafted request and no privileged code execution, the attack vector is most likely mediated by the application’s ability to load arbitrary URLs, making it potentially exploitable through phishing, embedded malicious web pages, or by manipulating a local user’s interaction with the application.