https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 10:13:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290283 EUVD-2026-290283 https://cve.radiocsirt.org/vuln/euvd-2026-290283 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35583 <p>Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.</p> <p>Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35583 https://cve.radiocsirt.org/vuln/ghsa-hxf2-gm22-7vcm <p><strong>Affected:</strong> Maven: gov.nsa.emissary:emissary</p> <p>## Summary</p> <p>The configuration API endpoint (`/api/configuration/{name}`) validated configuration names using a blacklist approach that checked for `\`, `/`, `..`, and trailing `.`. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory.</p> <p>## Details</p> <p>### Vulnerable code — `Configs.java` (line 126)</p> <p>```java protected static String validate(String config) { if (StringUtils.isBlank(config) || config.contains(&#34;\\&#34;) || config.contains(&#34;/&#34;) || config.contains(&#34;..&#34;) || config.endsWith(&#34;.&#34;)) { throw new IllegalArgumentException(&#34;Invalid config name: &#34; + config); } return Strings.CS.appendIfMissing(config.trim(), CONFIG_FILE_ENDING); } ```</p> <p>### Weakness</p> <p>The blacklist blocked literal `\`, `/`, `..`, and trailing `.` but could potentially miss:</p> <p>- URL-encoded variants (`%2e%2e%2f`) if decoded after validation - Double-encoded sequences (`%252e%252e%252f`) - Unicode normalization bypasses - The approach relies on string matching rather than canonical path resolution</p> <p>### Impact</p> <p>- Potential read access to configuration files outside the intended config directory - Information disclosure of sensitive configuration values</p> <p>## Remediation</p> <p>Fixed in [PR #1292](https://github.com/NationalSecurityAgency/emissary/pull/1292), merged into release 8.39.0.</p> <p>The blacklist was replaced with an allowlist regex that only permits character…</p> <p><strong>Affected:</strong> Maven: gov.nsa.emissary:emissary</p> <p>## Summary</p> <p>The configuration API endpoint (`/api/configuration/{name}`) validated configuration names using a blacklist approach that checked for `\`, `/`, `..`, and trailing `.`. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory.</p> <p>## Details</p> <p>### Vulnerable code — `Configs.java` (line 126)</p> <p>```java protected static String validate(String config) { if (StringUtils.isBlank(config) || config.contains(&#34;\\&#34;) || config.contains(&#34;/&#34;) || config.contains(&#34;..&#34;) || config.endsWith(&#34;.&#34;)) { throw new IllegalArgumentException(&#34;Invalid config name: &#34; + config); } return Strings.CS.appendIfMissing(config.trim(), CONFIG_FILE_ENDING); } ```</p> <p>### Weakness</p> <p>The blacklist blocked literal `\`, `/`, `..`, and trailing `.` but could potentially miss:</p> <p>- URL-encoded variants (`%2e%2e%2f`) if decoded after validation - Double-encoded sequences (`%252e%252e%252f`) - Unicode normalization bypasses - The approach relies on string matching rather than canonical path resolution</p> <p>### Impact</p> <p>- Potential read access to configuration files outside the intended config directory - Information disclosure of sensitive configuration values</p> <p>## Remediation</p> <p>Fixed in [PR #1292](https://github.com/NationalSecurityAgency/emissary/pull/1292), merged into release 8.39.0.</p> <p>The blacklist was replaced with an allowlist regex that only permits character…</p> https://cve.radiocsirt.org/vuln/ghsa-hxf2-gm22-7vcm