CVE-2026-92811
browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 16, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 16, 2026
Description
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
browserlessbrowserless |
|
References
- Researcher write-uptechnical-descriptionexploit
- the CDP class enforces getAllowFileProtocoltechnical-description
- the Playwright class never consults the settingtechnical-description
- https://github.com/browserless/browserlessproduct
- VulnCheck Advisory: browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.