CVE-2026-92811— browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
Quick assessment
Affected
browserless browserless
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and acc
Possible ATT&CK Techniques 3 AI
T1071.004 · DNS T1082 · System Information Discovery T1552.001 · Credentials In Files
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92811
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| browserless | browserless | 1.44.0 ~ 2.56.7 | - |
|
II. Public POCs for CVE-2026-92811
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92811
请登录查看更多情报信息。
Other References for CVE-2026-92811 (3)
-
🔗 oss/browserless.md at main · geo-chen/oss · GitHub Read full article technical-description exploit
-
-
IV. Related Vulnerabilities
Same weakness: CWE-200
-
CVE-2026-61588
djust's Django model serialization has no sensitive-field de -
CVE-2026-92594
Craft CMS before 5.11.0 Unauthenticated PII Disclosure via G -
CVE-2026-64684
RMCP: Custom HTTP headers leak to cross-origin redirect targ -
CVE-2026-92770
Harbor through 2.15.2 Scanner Credential Disclosure via Quer -
CVE-2026-20360
Cisco Nexus Dashboard Software Security Hardening Release Se
V. Comments for CVE-2026-92811
No comments yet