Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-35583— Emissary has a Path Traversal via Blacklist Bypass in Configuration API

Quick assessment

Affected
NationalSecurityAgency emissary
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Emissary是National Security Agency开源的一个分布式 P2P 数据驱动工作流框架。 Emissary 8.39.0之前版本存在路径遍历漏洞，该漏洞源于配置API端点使用黑名单方法验证配置名称，可能被URL编码变体、双重编码或Unicode规范化绕过，可能导致路径遍历和读取预期目录外的配置文件。

CVSS 5.3 · Medium EPSS 0.41% · P33
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-35583

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Emissary has a Path Traversal via Blacklist Bypass in Configuration API
Source: CVE Program / CVE List V5
Vulnerability Description
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Emissary 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Emissary是National Security Agency开源的一个分布式 P2P 数据驱动工作流框架。 Emissary 8.39.0之前版本存在路径遍历漏洞，该漏洞源于配置API端点使用黑名单方法验证配置名称，可能被URL编码变体、双重编码或Unicode规范化绕过，可能导致路径遍历和读取预期目录外的配置文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
NationalSecurityAgency emissary < 8.39.0 -

II. Public POCs for CVE-2026-35583

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-35583

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-35583 (1)

Same Patch Batch · NationalSecurityAgency · 2026-04-07 · 4 CVEs total

CVE-2026-35580 9.1 CRITICAL Emissary has GitHub Actions Shell Injection via Workflow Inputs
CVE-2026-35581 7.2 HIGH Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
CVE-2026-35571 4.8 MEDIUM Emissary has Stored XSS via Navigation Template Link Injection

IV. Related Vulnerabilities

Same product: emissary
Same vendor: NationalSecurityAgency
Same weakness: CWE-22

V. Comments for CVE-2026-35583

No comments yet

Leave a comment