Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

cve-program · CVE-2026-48796

Published

CefSharp

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "cefsharp",
                    "product": "CefSharp",
                    "versions": [
                        {
                            "version": "< 148.0.90",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-62186

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Aug 18, 2026, 9:17:16 PM

dateUpdated: Aug 19, 2026, 6:19:59 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-48796

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-22

Original publisher date fields

published: 2026-08-18T22:16:52.280

lastModified: 2026-11-09T20:10:00.200

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-85jm-cwp2-mvpv

Published

CefSharp.Common

NuGet

ECOSYSTEM · introduced 0 → fixed 148.0.90

218 versions listed as affected

100.0.120-pre, 100.0.140, 100.0.230, 101.0.150, 101.0.180, 102.0.100, 102.0.90, 103.0.120, 103.0.80, 103.0.90, 104.4.180, 104.4.240, 105.3.330, 105.3.390, 106.0.260, 106.0.290, 107.1.120, 107.1.40, 107.1.50, 107.1.90, 108.4.130, 109.1.110, 110.0.250, 110.0.280, 110.0.300, 111.2.20, 111.2.70, 112.2.70, 112.3.0, 113.1.40, 113.3.50, 114.2.100, 114.2.120, 115.3.110, 115.3.130, 116.0.130, 116.0.150, 116.0.190, 116.0.230, 117.2.20, 117.2.40, 118.6.80, 119.1.20, 119.4.30, 120.1.110, 120.1.80, 120.2.50, 120.2.70, 121.3.130, 121.3.70, 122.1.120, 123.0.60, 124.3.20, 124.3.50, 124.3.80, 125.0.210, 126.2.180, 126.2.70, 127.3.50, 128.4.90, 129.0.110, 130.1.90, 131.2.70, 131.3.10, 131.3.50, 132.3.11, 133.4.21, 134.3.60, 134.3.90, 135.0.170, 135.0.220, 136.1.40, 137.0.100, 138.0.170, 138.0.340, 139.0.280, 140.1.140, 141.0.110, 143.0.90, 144.0.120, 144.0.250, 144.0.260, 144.0.270, 144.0.300, 145.0.260, 146.0.100, 146.0.70, 147.0.100, 31.0.0-pre1, 33.0.0, 33.0.2, 33.1.0-pre01, 37.0.0, 37.0.0-pre01, 37.0.0-pre02, 37.0.1, 37.0.2, 37.0.3, 39.0.0, 39.0.0-pre01, 39.0.0-pre02, 39.0.0-pre03, 39.0.1, 39.0.2, 41.0.0, 41.0.0-pre01, 41.0.1, 43.0.0, 43.0.0-pre01, 43.0.0-pre02, 43.0.1, 45.0.0, 45.0.0-pre01, 47.0.0, 47.0.0-pre01, 47.0.1, 47.0.2, 47.0.3, 47.0.4, 49.0.0, 49.0.0-pre01, 49.0.0-pre02, 49.0.1, 51.0.0, 51.0.0-pre01, 51.0.0-pre02, 53.0.0, 53.0.0-pre01, 53.0.1, 55.0.0, 55.0.0-pre01, 57.0.0, 57.0.0-pre01, 62.0.0-pre01, 62.0.0-proprietary-codecs, 62.0.0-proprietary-codecs2, 63.0.0, 63.0.0-pre01, 63.0.0-pre02, 63.0.0-pre03, 63.0.1, 63.0.2, 63.0.3, 65.0.0, 65.0.0-pre01, 65.0.0-pre02, 65.0.1, 67.0.0, 67.0.0-pre01, 69.0.0, 69.0.0-pre01, 71.0.0, 71.0.0-pre01, 71.0.1, 71.0.2, 73.1.120-pre01, 73.1.130, 75.1.140-pre01, 75.1.141, 75.1.142, 75.1.143, 79.1.310-pre, 79.1.350, 79.1.360, 81.3.100, 81.3.20-pre, 83.3.120-pre, 83.4.20, 84.3.10-pre, 84.4.10, 85.3.120-pre, 85.3.121, 85.3.121-pre, 85.3.130, 86.0.240-pre, 86.0.241, 87.1.130-pre, 87.1.131-pre, 87.1.132, 88.2.40-pre, 88.2.90, 89.0.140-pre, 89.0.170, 90.5.70-pre, 90.6.50, 90.6.70, 91.1.160, 91.1.210, 91.1.211, 91.1.230, 91.1.60-pre, 92.0.250-pre, 92.0.251, 92.0.260, 93.1.110-pre, 93.1.111, 93.1.140, 94.3.0-pre, 94.4.110, 94.4.20, 94.4.50, 95.7.140-pre, 95.7.141, 96.0.140-pre, 96.0.141, 96.0.142, 96.0.170, 96.0.180, 97.1.10-pre, 97.1.11, 97.1.12, 97.1.60, 97.1.61, 98.1.190, 98.1.210, 99.2.120, 99.2.140, 99.2.90

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 11:08 UTC · 256 of 275 readable · 252 fully read · documentation 469/469 current