CVE-2026-35583

OVERVIEW CVE-2026-35583 affects Emissary, a peer-to-peer data-driven workflow engine, in versions prior to 8.39.0. The vulnerability exists in the configuration API endpoint (/api/configuration/{name}), where insufficient input validation on configuration names allows attackers to bypass blacklist restrictions through URL encoding, double-encoding, or Unicode normalization techniques to perform path traversal attacks and access configuration files outside the intended directory. SEVERITY This vulnerability carries a CVSS v3.1 score of 5.3 (MEDIUM) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The attack has limited scope and results in low confidentiality impact with no integrity or availability impact. The EPSS score of 0.0005 indicates relatively low predicted exploitation probability compared to other CVEs in the wild. EXPLOITATION STATUS Currently, there is no evidence of active exploitation in the wild, as indicated by the CVE not appearing on the KEV catalog and its Inactive status on the Hot List. The FAUCET Risk Score of 32.0/100 reflects a below-average risk level. However, organizations running Emissary versions prior to 8.39.0 should prioritize patching, as path traversal vulnerabilities in API endpoints can enable unauthorized access to sensitive configuration data.