Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.

Affected: Maven: gov.nsa.emissary:emissary

## Summary

The configuration API endpoint (`/api/configuration/{name}`) validated configuration names using a blacklist approach that checked for `\`, `/`, `..`, and trailing `.`. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory.

## Details

### Vulnerable code — `Configs.java` (line 126)

```java protected static String validate(String config) { if (StringUtils.isBlank(config) || config.contains("\\") || config.contains("/") || config.contains("..") || config.endsWith(".")) { throw new IllegalArgumentException("Invalid config name: " + config); } return Strings.CS.appendIfMissing(config.trim(), CONFIG_FILE_ENDING); } ```

### Weakness

The blacklist blocked literal `\`, `/`, `..`, and trailing `.` but could potentially miss:

- URL-encoded variants (`%2e%2e%2f`) if decoded after validation - Double-encoded sequences (`%252e%252e%252f`) - Unicode normalization bypasses - The approach relies on string matching rather than canonical path resolution

### Impact

- Potential read access to configuration files outside the intended config directory - Information disclosure of sensitive configuration values

## Remediation

Fixed in [PR #1292](https://github.com/NationalSecurityAgency/emissary/pull/1292), merged into release 8.39.0.

The blacklist was replaced with an allowlist regex that only permits character…