CVE-2026-35583: 
Java vulnerability analysis and mitigation

CVE-2026-35583 is a path traversal vulnerability in Emissary, a P2P-based data-driven workflow engine developed by the National Security Agency (NSA). The flaw exists in the configuration API endpoint (/api/configuration/{name}) in versions up to and including 8.38.0, where input validation relied on a blacklist approach that could be bypassed via URL-encoded variants, double-encoding, or Unicode normalization. It was published on April 7, 2026, and fixed in version 8.39.0. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, NSA Emissary Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), stemming from a blacklist-based validation in Configs.java (line 126) that checked for literal \, /, .., and trailing . characters but failed to account for encoded representations. An unauthenticated remote attacker could craft a request to /api/configuration/{name} using URL-encoded sequences (e.g., %2e%2e%2f), double-encoded sequences (e.g., %252e%252e%252f), or Unicode normalization (e.g., U+002F) that bypass the string-matching checks and resolve to a path outside the intended configuration directory. No authentication or user interaction is required, and attack complexity is low. The fix replaced the blacklist with an allowlist regex (^[a-zA-Z0-9._-]+$) that rejects any character outside the permitted set before the name reaches the filesystem (GitHub Advisory, NSA Emissary Advisory).

Successful exploitation allows an unauthenticated network attacker to read configuration files stored outside the intended configuration directory, resulting in information disclosure of potentially sensitive configuration values. There is no integrity or availability impact — the vulnerability is limited to confidentiality. Depending on the contents of accessible configuration files, exposed data could include credentials, internal network details, or other sensitive operational parameters that could facilitate further attacks (NSA Emissary Advisory).

No confirmed in-the-wild exploitation has been observed, and no functional proof-of-concept exploit is publicly available — the GitHub Security Advisory describes the vulnerability class and bypass techniques but does not provide a concrete exploitation sequence (NSA Emissary Advisory). The EPSS score is approximately 0.038% (0.000380), placing it in the 23rd percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Emissary instances running versions ≤ 8.38.0 using network scanning tools (e.g., Shodan, Censys) or by probing the /api/configuration/ endpoint for a valid response.
2. Craft traversal payload: Construct a path traversal payload using encoding techniques that bypass the blacklist — for example, URL-encoded %2e%2e%2f, double-encoded %252e%252e%252f, or Unicode-normalized variants of / (U+002F).
3. Send malicious request: Issue an unauthenticated HTTP GET request to the configuration API with the encoded traversal sequence, e.g., GET /api/configuration/%2e%2e%2fetc%2fpasswd.
4. Read disclosed files: If the server decodes the path after validation and before filesystem access, the response may contain the contents of files outside the intended configuration directory, such as system files or other application configuration files containing sensitive data (NSA Emissary Advisory).

• Network: Unusual HTTP GET requests to /api/configuration/ containing percent-encoded characters such as %2e, %2f, %5c, %252e, or Unicode escape sequences in the path parameter.
• Logs: Web server or application access logs showing requests to /api/configuration/{name} where {name} contains encoded dot or slash sequences; HTTP 200 responses to such requests on unpatched systems.
• Application: Unexpected file read operations by the Emissary process accessing paths outside the designated configuration directory, observable via file access auditing (e.g., Linux auditd with -w rules on sensitive directories).

Upgrade Emissary to version 8.39.0 or later, which replaces the blacklist validation with an allowlist regex (^[a-zA-Z0-9._-]+$) that rejects encoded traversal characters before they reach the filesystem (NSA Emissary Advisory). For systems that cannot be immediately patched, restrict network access to the /api/configuration/ endpoint to trusted networks only, and deploy a reverse proxy or WAF rule that blocks requests containing encoded path traversal sequences (e.g., %2e, %2f, %5c, %25, and Unicode variants) (GitHub Advisory).