CVE-2026-35583

🗓️ 07 Apr 2026 15:57:41Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 6 Views🌐 WEB

CVE-2026-35583: Emissary configuration API path traversal via blacklist bypass; fixed in 8.39.0.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-35583	7 Apr 202615:57	–	attackerkb
CNNVD	Emissary 路径遍历漏洞	7 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-35583 Emissary has a Path Traversal via Blacklist Bypass in Configuration API	7 Apr 202615:57	–	cvelist
EUVD	EUVD-2026-19732	8 Apr 202600:12	–	euvd
Github Security Blog	Emissary has a Path Traversal via Blacklist Bypass in Configuration API	8 Apr 202600:12	–	github
NVD	CVE-2026-35583	7 Apr 202617:16	–	nvd
OSV	GHSA-HXF2-GM22-7VCM Emissary has a Path Traversal via Blacklist Bypass in Configuration API	8 Apr 202600:12	–	osv
Positive Technologies	PT-2026-30894	7 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-35583	9 Apr 202619:23	–	redhatcve
Snyk	Directory Traversal	8 Apr 202600:12	–	snyk

NVD

Vulners

Node

nsa emissaryRange≤8.38.0

[
  {
    "vendor": "NationalSecurityAgency",
    "product": "emissary",
    "versions": [
      {
        "version": "< 8.39.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-hxf2-gm22-7vcm

Parameter	Position	Path	Description	CWE
name	path	/api/configuration/{name}	Path traversal via configuration name in path parameter allowing access to files outside intended directory	CWE-22

17 Jun 2026 10:40Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.3

EPSS0.0032

SSVC

CWE-22