Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M
CVE-2026-35583Emissary has a Path Traversal via Blacklist Bypass in Configuration API
Medium 5.3
In plain English
A medium-severity path traversal in emissary from NationalSecurityAgency. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | gov.nsa.emissary:emissary | 8.39.0 | GHSA-hxf2-gm22-7vcm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NationalSecurityAgency | emissary | < 8.39.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N