Fabasoft Folio Client CVE-2026-97155

Exploitation requires that the victim's machine has Fabasoft Folio Client (a build before 26.0.0.10 / 26.4.0.76) AND the Fabasoft browser extension installed, with the registry value VALIDDOMAINS unset or empty - which is the default, meaning all web origins are trusted. The victim must actively browse to attacker-controlled or compromised web content (UI:R). Exploitation is LIMITED by: required user interaction (visiting a page), the need for both client and extension to be present and running, and the fact that setting VALIDDOMAINS to an allowlist of legitimate origins or upgrading to the fixed builds fully mitigates it; organizations that already restricted VALIDDOMAINS are not exposed.

This is a moderate, opportunistic-risk issue rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5) shows a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must visit an attacker-controlled web page while running both the Folio Client and its browser extension. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so all three exploitation-likelihood signals are absent; combined with a niche enterprise/government install base, this points to low probability of mass exploitation. The most notable data tension is that the vendor rated confidentiality C:N while the description explicitly lists 'downloading documents' and NVD tags it 'Information Disclosure' - because the client↔extension channel is web messaging (typically bidirectional), a malicious origin plausibly receives document data back, which would justify some confidentiality impact; verify with vendor. Conversely I:H seems generous: the invokable operations (download/open/sync) trigger legitimate client actions rather than arbitrary file modification, so real integrity impact is likely bounded. Net: a genuine origin-validation weakness worth patching on affected fleets, but not a drop-everything item absent evidence of exploitation.

An attacker lures a user who has Fabasoft Folio Client and its browser extension installed to a malicious or compromised website. Because VALIDDOMAINS is empty by default, the page's JavaScript sends web messages that the client accepts from any origin, invoking privileged functions such as downloading, opening, or synchronizing the user's Folio documents. No public exploit code was identified at time of analysis, but the technique is straightforward web scripting requiring only that the victim visit the page.