CVE-2026-35583
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Emissary before 8.39.0 validates configuration names in the /api/configuration/{name} endpoint using a blacklist checking for \, /, .., and trailing ... This can be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. Fixed in 8.39.0.
Risk Assessment
Path traversal may allow reading sensitive configuration files, including credentials or API keys. This can lead to further escalation and compromise of the system.
Recommendation
Update Emissary to version 8.39.0 or later. Until then, restrict access to the /api/configuration endpoint and monitor suspicious requests with encoded characters.
Other vulnerabilities in Emissary
See all- CVE-2026-35582High
Emissary versions 8.42.0 and below contain an OS command injection vulnerability in Executrix.getCommand() because temporary file paths are interpolated into a /bin/sh -c shell command string without escaping. The IN_FILE_ENDING and OUT_FILE_ENDING configuration keys flow directly into these paths, allowing a place author who can edit a .cfg file to inject shell metacharacters and execute commands in the JVM process's security context.
- CVE-2026-35571Medium
Emissary prior to 8.39.0 interpolated configuration-controlled link values directly into href attributes in Mustache navigation templates without URL scheme validation. An administrator able to modify the navItems configuration could inject javascript: URIs, enabling stored XSS against other authenticated users viewing the Emissary web interface.
Original NVD description (English source)
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS