CVE-2026-35583

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-355846.5FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversa CVE-2026-355857.2File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Fro CVE-2026-355866.8pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set i CVE-2026-355878.8Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery (SSRF) vulnerability CVE-2026-355886.3Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glanc CVE-2026-355899.3nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bri CVE-2026-35598.1Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent a CVE-2026-355905.5libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was n CVE-2026-355917.8libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 c CVE-2026-355926.5pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/p CVE-2026-355936.8Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0 CVE-2026-355946.5Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims