PT-2026-30894 · Emissary · Emissary

Brennantm · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-35583

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Emissary versions prior to 8.39.0

Description Emissary is a P2P based data-driven workflow engine. Prior to version 8.39.0, the configuration API endpoint /api/configuration/{name} validated configuration names using a blacklist approach that checked for , /, .., and trailing .. This validation could be bypassed using URL-encoded variants, double-encoding, or Unicode normalization, potentially leading to path traversal and the ability to read configuration files outside the intended directory.

Recommendations Update to version 8.39.0 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35583

GHSA-HXF2-GM22-7VCM

Affected Products

Emissary

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-35583 · Security Note
• https://osv.dev/vulnerability/GHSA-hxf2-gm22-7vcm · Vendor Advisory
• https://github.com/NationalSecurityAgency/emissary · Note
• https://github.com/NationalSecurityAgency/emissary/pull/1292 · Note
• https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-hxf2-gm22-7vcm · Note
• https://reddit.com/r/VulnMatter/comments/1sft88v/resumen_diario_de_vulnerabilidades_08042026 · Reddit Post
• https://twitter.com/CVEnew/status/2041570002562859059 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041570838965616843 · Twitter Post