{"id":"GHSA-hxf2-gm22-7vcm","summary":"Emissary has a Path Traversal via Blacklist Bypass in Configuration API","details":"## Summary\n\nThe configuration API endpoint (`/api/configuration/{name}`) validated\nconfiguration names using a blacklist approach that checked for `\\`, `/`, `..`,\nand trailing `.`. This could potentially be bypassed using URL-encoded variants,\ndouble-encoding, or Unicode normalization to achieve path traversal and read\nconfiguration files outside the intended directory.\n\n## Details\n\n### Vulnerable code — `Configs.java` (line 126)\n\n```java\nprotected static String validate(String config) {\n    if (StringUtils.isBlank(config) || config.contains(\"\\\\\") || config.contains(\"/\")\n        || config.contains(\"..\") || config.endsWith(\".\")) {\n        throw new IllegalArgumentException(\"Invalid config name: \" + config);\n    }\n    return Strings.CS.appendIfMissing(config.trim(), CONFIG_FILE_ENDING);\n}\n```\n\n### Weakness\n\nThe blacklist blocked literal `\\`, `/`, `..`, and trailing `.` but could\npotentially miss:\n\n- URL-encoded variants (`%2e%2e%2f`) if decoded after validation\n- Double-encoded sequences (`%252e%252e%252f`)\n- Unicode normalization bypasses\n- The approach relies on string matching rather than canonical path resolution\n\n### Impact\n\n- Potential read access to configuration files outside the intended config\n  directory\n- Information disclosure of sensitive configuration values\n\n## Remediation\n\nFixed in [PR #1292](https://github.com/NationalSecurityAgency/emissary/pull/1292),\nmerged into release 8.39.0.\n\nThe blacklist was replaced with an allowlist regex that only permits characters\nmatching `^[a-zA-Z0-9._-]+$`:\n\n```java\nprotected static final Pattern VALID_CONFIG_NAME = Pattern.compile(\"^[a-zA-Z0-9._-]+$\");\n\nprotected static String validate(String config) {\n    if (!VALID_CONFIG_NAME.matcher(config).matches() || config.contains(\"..\") || config.endsWith(\".\")) {\n        throw new IllegalArgumentException(\"Invalid config name: \" + config);\n    }\n    return Strings.CS.appendIfMissing(config.trim(), CONFIG_FILE_ENDING);\n}\n```\n\nThis ensures that any character outside the allowed set — including encoded\nslashes, percent signs, and Unicode sequences — is rejected before the config\nname reaches the filesystem.\n\nTests were added to verify that URL-encoded (`%2e%2e%2f`), double-encoded\n(`%252e%252e%252f`), and Unicode (`U+002F`) traversal attempts are blocked.\n\n## Workarounds\n\nIf upgrading is not immediately possible, deploy a reverse proxy or WAF rule\nthat rejects requests to `/api/configuration/` containing encoded path traversal\nsequences.\n\n## References\n\n- [PR #1292 — validate config name with an allowlist](https://github.com/NationalSecurityAgency/emissary/pull/1292)\n- Original report: GHSA-wjqm-p579-x3ww","aliases":["CVE-2026-35583"],"modified":"2026-04-08T00:27:17.482740Z","published":"2026-04-08T00:12:55Z","database_specific":{"github_reviewed_at":"2026-04-08T00:12:55Z","nvd_published_at":"2026-04-07T17:16:33Z","cwe_ids":["CWE-22"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-hxf2-gm22-7vcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35583"},{"type":"WEB","url":"https://github.com/NationalSecurityAgency/emissary/pull/1292"},{"type":"PACKAGE","url":"https://github.com/NationalSecurityAgency/emissary"}],"affected":[{"package":{"name":"gov.nsa.emissary:emissary","ecosystem":"Maven","purl":"pkg:maven/gov.nsa.emissary/emissary"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.39.0"}]}],"versions":["8.0.0","8.1.0","8.10.0","8.11.0","8.11.1","8.12.0","8.13.0","8.14.0","8.15.0","8.16.0","8.17.0","8.18.0","8.19.0","8.19.1","8.2.0","8.20.0","8.21.0","8.22.0","8.23.0","8.24.0","8.25.0","8.26.0","8.27.0","8.28.0","8.29.0","8.3.0","8.30.0","8.31.0","8.32.0","8.33.0","8.34.0","8.35.0","8.36.0","8.37.0","8.38.0","8.4.0","8.5.0","8.6.0","8.7.0","8.7.1","8.8.0","8.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-hxf2-gm22-7vcm/GHSA-hxf2-gm22-7vcm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}