# Flash “local-with-filesystem” Bypass in navigateToURL

Flash's local-with-filesystem policy was bypassed via navigateToURL using a \\.\localhost/c:\windows\ path, letting a malicious SWF read local files in IE.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: irsdl
- Disclosed: 2019-10-17
- CVE: CVE-2016-4178
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/150976
- Library page: https://bugbountylibrary.com/r/h1%3A150976
- Tags: area:os domain:browser domain:desktop impact:data-leak kind:bounty platform:hackerone sev:medium tech:windows technique:parser-differential vuln:access-control vuln:info-disclosure

**Target:** Flash Player navigateToURL / local-with-filesystem sandbox
**Root cause:** navigateToURL did not normalize the \\.\localhost/ UNC-style path, so the local-with-filesystem restriction was not applied and local file/directory access was granted.
**Steps:**
1. Load a malicious SWF in Internet Explorer with a parameter controlling the navigateToURL target.
2. Pass `\\.\localhost/c:\windows\` as the input to open the Windows directory.
3. For file access use `\\.\localhost/c:\windows\starter.xml` inside an iframe PoC page.
4. Observe local filesystem contents rendered despite the local-with-filesystem policy.
**How found:** Prior research on navigateToURL and jar: protocol abuse led to testing alternate path forms (UNC-style \\.\localhost) against the local-with-filesystem restriction.
**Exploitation:** A website-hosted SWF loaded in IE calls navigateToURL with a crafted \\.\localhost/ path, causing the player to treat it as local and render local files/directories in an iframe, enabling local file disclosure.
**Insight:** When a sandbox blocks file:// and \\localhost\c$, try alternate UNC/device path spellings like \\.\localhost/ and \\.\/C:\ that parsers may normalize differently than the policy check.