medium5.3
CVE-2026-35583
Emissary has a Path Traversal via Blacklist Bypass in Configuration API
Impact
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | gov.nsa.emissary:emissary | < 8.39.0 | 8.39.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nsa | Emissary | through 8.38.0 |