Emissary, a P2P data-driven workflow engine by the NationalSecurityAgency, had a path traversal vulnerability (CWE-22) in versions before 8.39.0. The configuration API endpoint (/api/configuration/{name}) validated input using a blacklist that checked for characters like \, /, .., and trailing .., but this approach was bypassable using URL-encoded variants, double-encoding, or Unicode normalization. This flaw allowed attackers to access configuration files outside the intended directory. The vulnerability was addressed and fixed in version 8.39.0. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can exploit this vulnerability remotely without authentication or user interaction to read configuration files outside the intended directory. This could lead to disclosure of sensitive configuration data. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.

This vulnerability is fixed in emissary version 8.39.0. Users should upgrade to version 8.39.0 or later to remediate this issue. Patch status is not explicitly stated beyond the fix in 8.39.0, so confirm with the vendor advisory for the latest remediation guidance. No other mitigations are specified.